🌐 Complete Guide to Cisco IOS CLI

# Console connection (serial)
screen /dev/ttyUSB0 9600

# Or using minicom
minicom -D /dev/ttyUSB0

# SSH connection
ssh admin@192.168.1.1

# Telnet (insecure, avoid in production)
telnet 192.168.1.1

# SSH connection
ssh user@192.168.1.100

# Serial console
screen /dev/ttyS0 115200

# Or
minicom -D /dev/ttyS0

# Commands can be abbreviated to unique characters
show running-config
sh run         # Same as above

configure terminal
conf t         # Same as above

interface GigabitEthernet0/0
int gi0/0      # Same as above

# View all commands starting with 'sh'
sh?

# Aliases must be defined
alias ll='ls -la'
alias gs='git status'

# Tab completion works similarly
systemctl sta[TAB]  # Completes to 'status'

Router> enable                    # User EXEC to Privileged EXEC
Password: 
Router# configure terminal        # Enter Global Config mode
Router(config)# interface gi0/0   # Enter Interface Config mode
Router(config-if)# exit           # Back to Global Config
Router(config)# exit              # Back to Privileged EXEC
Router# disable                   # Back to User EXEC
Router> exit                      # Logout

# Quick navigation
Router(config-if)# end            # Jump to Privileged EXEC from anywhere
Router(config-if)# Ctrl+Z         # Same as 'end'

# Go up one level
Router(config-if)# exit

# Return to Privileged EXEC
Router(config)# end

# Regular user to root
$ sudo -i
# Or
$ su -

# Regular user to root for single command
$ sudo command

# Exit root back to user
# exit

# Editing configuration
# vim /etc/network/interfaces  # Like entering interface config mode
# systemctl restart networking # Apply changes

# Context-sensitive help
Router# ?                         # Show all available commands
Router# show ?                    # Show all 'show' subcommands
Router# show ip ?                 # Show all 'show ip' options

# Partial command help
Router# sh?                       # Show commands starting with 'sh'
show

# Command syntax help
Router# show interfaces ?
  GigabitEthernet  GigabitEthernet interface
  Vlan             Vlan interface
  status           Interface status
  <cr>             Carriage return (press Enter)

# Middle-of-command help
Router# show ? running-config     # Help in middle of command

# Manual pages
$ man command                     # Full documentation
$ man -k keyword                  # Search man pages

# Command help
$ command --help                  # Quick help
$ command -h                      # Short help

# Info pages
$ info command                    # Detailed documentation

# Apropos - search commands
$ apropos network                 # Find network-related commands

# Which/whereis
$ which command                   # Show command location
$ whereis command                 # Show binary, source, man pages

# Tab completion
$ systemctl [TAB][TAB]           # Show available options

# Version and system info
show version
show inventory

# Running configuration
show running-config
show run                          # Abbreviated

# Startup configuration (saved config)
show startup-config
show start

# Hostname
show running-config | include hostname

# Memory usage
show memory
show processes memory

# CPU usage
show processes cpu

# Flash memory
show flash:
dir flash:

# System information
$ uname -a                        # Kernel version
$ lsb_release -a                  # Distribution info
$ hostnamectl                     # System info

# Hardware info
$ lshw                            # Detailed hardware
$ dmidecode                       # DMI/SMBIOS info

# Current configuration
$ cat /etc/network/interfaces     # Network config
$ systemctl status service        # Service status

# Saved/boot configuration
$ cat /etc/default/grub           # Boot config

# Hostname
$ hostname
$ cat /etc/hostname

# Memory usage
$ free -h
$ cat /proc/meminfo

# CPU usage
$ top
$ htop
$ mpstat

# Disk usage
$ df -h
$ du -sh /path

# Interface status
show ip interface brief
show interfaces status

# Detailed interface info
show interfaces GigabitEthernet0/0
show interface gi0/0

# Interface statistics
show interfaces gi0/0 stats

# IP routing table
show ip route

# ARP table
show arp
show ip arp

# MAC address table (switches)
show mac address-table

# CDP neighbors (Cisco Discovery Protocol)
show cdp neighbors
show cdp neighbors detail

# LLDP neighbors
show lldp neighbors
show lldp neighbors detail

# VLAN information (switches)
show vlan
show vlan brief

# Interface status
$ ip link show                    # All interfaces
$ ip addr show                    # With IP addresses
$ ifconfig -a                     # Old style

# Interface details
$ ethtool eth0                    # Interface details
$ ip -s link show eth0            # Statistics

# Interface statistics
$ ifconfig eth0                   # Basic stats
$ ip -s -s link show eth0         # Detailed stats
$ cat /proc/net/dev               # All interface stats

# Routing table
$ ip route show
$ route -n                        # Old style
$ netstat -rn                     # Old style

# ARP table
$ ip neighbor show
$ arp -n                          # Old style

# Bridge/switch MAC table (if using Linux bridge)
$ bridge fdb show

# Neighbor discovery (similar to CDP/LLDP)
$ lldpcli show neighbors          # Requires lldpd
$ lldpctl                         # Alternative

# VLAN information
$ ip link show type vlan
$ cat /proc/net/vlan/config

# Device uptime
show version | include uptime

# Current sessions
show users
show line

# Logging
show logging

# Clock/time
show clock

# Environment (temperature, fans, power)
show environment
show environment all

# Hardware status
show inventory
show diag

# System uptime
$ uptime
$ who -b                          # Boot time

# Current sessions
$ who
$ w
$ users
$ last                            # Login history

# Logging
$ journalctl                      # systemd logs
$ tail -f /var/log/syslog        # Real-time logs
$ dmesg                           # Kernel messages

# Clock/time
$ date
$ timedatectl

# Environment (sensors)
$ sensors                         # Temperature, fans
$ lm-sensors                      # Hardware monitoring

# Hardware status
$ lspci                           # PCI devices
$ lsusb                           # USB devices
$ lsblk                           # Block devices

Router# configure terminal
Router(config)# 

# Alternative
Router# conf t
Router(config)#

# Edit configuration files
$ sudo vim /etc/network/interfaces
$ sudo vim /etc/sysconfig/network-scripts/ifcfg-eth0

# Or use configuration tools
$ sudo nmtui                      # NetworkManager TUI
$ sudo nmcli                      # NetworkManager CLI

Router(config)# hostname ROUTER01
Router(config)# 

# Set domain name
Router(config)# ip domain-name example.com

# Set DNS servers
Router(config)# ip name-server 8.8.8.8
Router(config)# ip name-server 8.8.4.4

# Set time zone
Router(config)# clock timezone EST -5
Router(config)# clock summer-time EDT recurring

# Set clock manually
Router# clock set 14:30:00 31 October 2025

# Enable NTP
Router(config)# ntp server pool.ntp.org

# Disable DNS lookups (for typo prevention)
Router(config)# no ip domain-lookup

# Set hostname
$ sudo hostnamectl set-hostname server01
# Or edit files
$ sudo vim /etc/hostname
$ sudo vim /etc/hosts

# Set domain name
$ sudo vim /etc/resolv.conf
# Add: search example.com

# Set DNS servers
$ sudo vim /etc/resolv.conf
nameserver 8.8.8.8
nameserver 8.8.4.4

# Set timezone
$ sudo timedatectl set-timezone America/New_York

# Set time manually
$ sudo timedatectl set-time "2025-10-31 14:30:00"

# Enable NTP
$ sudo timedatectl set-ntp true
$ sudo vim /etc/systemd/timesyncd.conf
# Configure NTP servers

# Save running config to startup config
Router# copy running-config startup-config
Router# copy run start            # Abbreviated
Router# write memory              # Alternative
Router# wr                        # Abbreviated

# Verify configs are same
Router# show running-config
Router# show startup-config

# Save to TFTP server
Router# copy running-config tftp:
Address or name of remote host []? 192.168.1.100
Destination filename [router-config]? backup-config

# Save to USB
Router# copy running-config usbflash0:config-backup

# Configuration changes are usually persistent
# But some require service restart

# Save iptables rules
$ sudo iptables-save > /etc/iptables/rules.v4
$ sudo ip6tables-save > /etc/iptables/rules.v6

# NetworkManager saves automatically
$ sudo nmcli con up connection-name  # Apply and save

# Systemd changes
$ sudo systemctl daemon-reload    # Reload config files

# Manual backup
$ sudo cp /etc/network/interfaces /etc/network/interfaces.bak
$ sudo tar czf /backup/etc-$(date +%Y%m%d).tar.gz /etc/

# Remote backup via SCP
$ sudo scp /etc/network/interfaces user@backup-server:/backups/

# Enter interface configuration
Router(config)# interface GigabitEthernet0/0
Router(config-if)# 

# Assign IP address and subnet mask
Router(config-if)# ip address 192.168.1.1 255.255.255.0

# Enable interface
Router(config-if)# no shutdown

# Add description
Router(config-if)# description Link to Core Switch

# Set speed and duplex
Router(config-if)# speed 1000
Router(config-if)# duplex full

# Configure multiple interfaces (range)
Router(config)# interface range gi0/1 - 4
Router(config-if-range)# switchport mode access
Router(config-if-range)# switchport access vlan 10

# View interface status
Router# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     192.168.1.1     YES manual up                    up
GigabitEthernet0/1     unassigned      YES unset  administratively down down

# Temporary configuration (lost on reboot)
$ sudo ip addr add 192.168.1.1/24 dev eth0
$ sudo ip link set eth0 up

# Persistent configuration - Debian/Ubuntu
$ sudo vim /etc/network/interfaces
auto eth0
iface eth0 inet static
    address 192.168.1.1
    netmask 255.255.255.0
    # Or CIDR: address 192.168.1.1/24

# Apply changes
$ sudo systemctl restart networking
# Or
$ sudo ifdown eth0 && sudo ifup eth0

# Persistent configuration - RHEL/CentOS
$ sudo vim /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
IPADDR=192.168.1.1
NETMASK=255.255.255.0
ONBOOT=yes

# Apply changes
$ sudo systemctl restart network
# Or
$ sudo ifdown eth0 && sudo ifup eth0

# Using NetworkManager
$ sudo nmcli con mod "Wired connection 1" \
    ipv4.addresses 192.168.1.1/24 \
    ipv4.method manual
$ sudo nmcli con up "Wired connection 1"

# Set speed and duplex
$ sudo ethtool -s eth0 speed 1000 duplex full autoneg off

# Persistent speed/duplex (Debian)
$ sudo vim /etc/network/interfaces
auto eth0
iface eth0 inet static
    address 192.168.1.1/24
    post-up ethtool -s eth0 speed 1000 duplex full autoneg off

# View interface status
$ ip link show
$ ip addr show
$ ifconfig -a

# Create VLAN
Switch(config)# vlan 10
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit

# Assign interface to VLAN (access port)
Switch(config)# interface gi0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

# Configure trunk port
Switch(config)# interface gi0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30

# View VLANs
Switch# show vlan brief

# Router-on-a-stick (inter-VLAN routing)
Router(config)# interface gi0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0

Router(config)# interface gi0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

# Create VLAN interface (requires 8021q module)
$ sudo modprobe 8021q
$ sudo ip link add link eth0 name eth0.10 type vlan id 10
$ sudo ip addr add 192.168.10.1/24 dev eth0.10
$ sudo ip link set eth0.10 up

# Persistent VLAN - Debian/Ubuntu
$ sudo vim /etc/network/interfaces
auto eth0.10
iface eth0.10 inet static
    address 192.168.10.1
    netmask 255.255.255.0
    vlan-raw-device eth0

# Persistent VLAN - RHEL/CentOS
$ sudo vim /etc/sysconfig/network-scripts/ifcfg-eth0.10
DEVICE=eth0.10
BOOTPROTO=static
IPADDR=192.168.10.1
NETMASK=255.255.255.0
VLAN=yes
ONBOOT=yes

# Using bridge for switching (Linux bridge)
$ sudo ip link add br0 type bridge
$ sudo ip link set eth0 master br0
$ sudo ip link set eth1 master br0
$ sudo ip link set br0 up

# VLAN filtering on bridge
$ sudo bridge vlan add vid 10 dev eth0
$ sudo bridge vlan add vid 20 dev eth0

# View VLANs
$ ip -d link show type vlan
$ cat /proc/net/vlan/config
$ bridge vlan show

# Add static route
Router(config)# ip route 10.0.0.0 255.255.255.0 192.168.1.254
# Format: ip route [destination] [subnet mask] [next-hop]

# Default route
Router(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.254

# Static route with exit interface
Router(config)# ip route 10.0.0.0 255.255.255.0 GigabitEthernet0/1

# Static route with administrative distance
Router(config)# ip route 10.0.0.0 255.255.255.0 192.168.1.254 10

# Floating static route (backup)
Router(config)# ip route 10.0.0.0 255.255.255.0 192.168.1.253 200

# Remove static route
Router(config)# no ip route 10.0.0.0 255.255.255.0 192.168.1.254

# View routing table
Router# show ip route
Router# show ip route static

# Add static route (temporary)
$ sudo ip route add 10.0.0.0/24 via 192.168.1.254

# Default route
$ sudo ip route add default via 192.168.1.254

# Static route with interface
$ sudo ip route add 10.0.0.0/24 dev eth1

# Route with metric (lower is better)
$ sudo ip route add 10.0.0.0/24 via 192.168.1.254 metric 10

# Delete route
$ sudo ip route del 10.0.0.0/24

# Persistent routes - Debian/Ubuntu
$ sudo vim /etc/network/interfaces
auto eth0
iface eth0 inet static
    address 192.168.1.1
    netmask 255.255.255.0
    gateway 192.168.1.254
    up ip route add 10.0.0.0/24 via 192.168.1.254

# Persistent routes - RHEL/CentOS
$ sudo vim /etc/sysconfig/network-scripts/route-eth0
10.0.0.0/24 via 192.168.1.254 dev eth0

# View routing table
$ ip route show
$ route -n                        # Old style
$ netstat -rn                     # Old style

# Enable OSPF
Router(config)# router ospf 1
Router(config-router)# router-id 1.1.1.1
Router(config-router)# network 192.168.1.0 0.0.0.255 area 0
Router(config-router)# network 10.0.0.0 0.0.0.255 area 0

# Passive interface (don't send OSPF on this interface)
Router(config-router)# passive-interface GigabitEthernet0/0

# Default route propagation
Router(config-router)# default-information originate

# View OSPF information
Router# show ip ospf
Router# show ip ospf neighbor
Router# show ip ospf database
Router# show ip ospf interface

# Using FRRouting (FRR) - modern routing daemon suite
# Install FRR first

# Enter FRR configuration
$ sudo vtysh

# Configure OSPF (inside vtysh)
router# configure terminal
router(config)# router ospf
router(config-router)# ospf router-id 1.1.1.1
router(config-router)# network 192.168.1.0/24 area 0
router(config-router)# network 10.0.0.0/24 area 0
router(config-router)# exit
router(config)# exit
router# write memory

# Or edit config file directly
$ sudo vim /etc/frr/ospfd.conf

# View OSPF information
$ sudo vtysh -c "show ip ospf"
$ sudo vtysh -c "show ip ospf neighbor"
$ sudo vtysh -c "show ip ospf database"

# Alternative: Quagga (older, being replaced by FRR)
$ sudo vim /etc/quagga/ospfd.conf

# Configure NAT (overload/PAT)
Router(config)# interface gi0/0
Router(config-if)# ip nat inside
Router(config-if)# exit

Router(config)# interface gi0/1
Router(config-if)# ip nat outside
Router(config-if)# exit

# Create access list for NAT
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255

# Enable NAT overload (PAT)
Router(config)# ip nat inside source list 1 interface gi0/1 overload

# Static NAT (one-to-one)
Router(config)# ip nat inside source static 192.168.1.100 203.0.113.10

# Port forwarding
Router(config)# ip nat inside source static tcp 192.168.1.100 80 203.0.113.10 8080

# View NAT translations
Router# show ip nat translations
Router# show ip nat statistics

# Clear NAT translations
Router# clear ip nat translation *

# Using iptables for NAT
# Enable IP forwarding first
$ sudo sysctl -w net.ipv4.ip_forward=1

# Make permanent
$ sudo vim /etc/sysctl.conf
net.ipv4.ip_forward = 1

# Masquerading (PAT/NAT overload)
$ sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Or with specific source network
$ sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 -j MASQUERADE

# SNAT (specify public IP)
$ sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 -j SNAT --to-source 203.0.113.10

# Static NAT (DNAT)
$ sudo iptables -t nat -A PREROUTING -d 203.0.113.10 -j DNAT --to-destination 192.168.1.100

# Port forwarding
$ sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.100:80

# View NAT rules
$ sudo iptables -t nat -L -n -v

# View connection tracking
$ sudo conntrack -L

# Save iptables rules
$ sudo iptables-save > /etc/iptables/rules.v4
$ sudo netfilter-persistent save  # On Debian/Ubuntu

# List files
Router# dir
Router# dir flash:
Router# show flash:

# Change directory
Router# cd flash:

# Show current directory
Router# pwd

# View file contents
Router# more flash:config.txt

# Copy files
Router# copy flash:old-config flash:new-config

# Delete files
Router# delete flash:old-config

# Permanently remove deleted files
Router# squeeze flash:

# Create directory
Router# mkdir flash:backups

# Remove directory
Router# rmdir flash:backups

# Format flash (DANGER!)
Router# format flash:

# Copy from TFTP
Router# copy tftp: flash:
Address or name of remote host []? 192.168.1.100
Source filename []? ios-image.bin
Destination filename [ios-image.bin]?

# Copy to TFTP
Router# copy flash: tftp:
Source filename []? config-backup
Address or name of remote host []? 192.168.1.100
Destination filename [config-backup]?

# List files
$ ls
$ ls -la                          # Detailed listing
$ ls /var/log

# Change directory
$ cd /var/log

# Show current directory
$ pwd

# View file contents
$ cat file.txt
$ more file.txt
$ less file.txt

# Copy files
$ cp old-config new-config
$ cp -r directory/ backup/       # Recursive

# Delete files
$ rm old-config
$ rm -r directory/                # Recursive delete

# No "squeeze" needed in Linux

# Create directory
$ mkdir backups
$ mkdir -p path/to/nested/dir    # Create parent dirs

# Remove directory
$ rmdir empty-dir                 # Only if empty
$ rm -r directory/                # Remove with contents

# Format/create filesystem
$ sudo mkfs.ext4 /dev/sdb1

# Copy from remote (SCP)
$ scp user@192.168.1.100:/path/file.txt .
$ rsync -avz user@host:/path/ /local/path/

# Copy to remote
$ scp file.txt user@192.168.1.100:/path/
$ rsync -avz /local/path/ user@host:/remote/path/

# Backup configuration to TFTP
Router# copy running-config tftp:
Address or name of remote host []? 192.168.1.100
Destination filename [router-config]? router1-config-20251031

# Backup to USB
Router# copy running-config usbflash0:config-backup-20251031

# Backup IOS image
Router# copy flash:c2900-universalk9-mz.SPA.157-3.M6.bin tftp:

# Restore configuration from TFTP
Router# copy tftp: running-config
Address or name of remote host []? 192.168.1.100
Source filename []? router1-config-backup

# Restore to startup config (will apply on reboot)
Router# copy tftp: startup-config

# Restore from USB
Router# copy usbflash0:config-backup running-config

# Upgrade IOS
Router# copy tftp: flash:
# Then change boot variable
Router(config)# boot system flash:new-ios-image.bin
Router(config)# exit
Router# write memory
Router# reload

# Backup configuration
$ sudo tar czf /backup/etc-$(date +%Y%m%d).tar.gz /etc/

# Backup to remote server
$ sudo tar czf - /etc | ssh user@backup-server "cat > /backups/etc-$(date +%Y%m%d).tar.gz"
$ sudo rsync -avz /etc/ user@backup-server:/backups/etc/

# Backup specific configs
$ sudo cp /etc/network/interfaces /backup/interfaces.$(date +%Y%m%d)
$ sudo cp -r /etc/nginx/ /backup/nginx.$(date +%Y%m%d)/

# Restore configuration
$ sudo tar xzf /backup/etc-20251031.tar.gz -C /

# Restore from remote
$ ssh user@backup-server "cat /backups/etc-20251031.tar.gz" | sudo tar xzf - -C /

# Backup entire system (excluding some dirs)
$ sudo rsync -aAXv --exclude={"/dev/*","/proc/*","/sys/*","/tmp/*","/run/*","/mnt/*","/media/*","/lost+found"} / /backup/

# Restore single file
$ sudo cp /backup/interfaces.20251031 /etc/network/interfaces
$ sudo systemctl restart networking

# System upgrade (similar to IOS upgrade)
$ sudo apt update
$ sudo apt dist-upgrade           # Debian/Ubuntu
$ sudo yum update                 # RHEL/CentOS
$ sudo dnf upgrade                # Fedora

# Ping
Router# ping 8.8.8.8
Router# ping 8.8.8.8 repeat 100
Router# ping 8.8.8.8 size 1500

# Extended ping
Router# ping
Protocol [ip]: 
Target IP address: 8.8.8.8
Repeat count [5]: 100
Datagram size [100]: 1500
Timeout in seconds [2]: 2
Extended commands [n]: y
Source address or interface: 192.168.1.1
...

# Traceroute
Router# traceroute 8.8.8.8

# Telnet (test TCP port)
Router# telnet 192.168.1.100 80

# SSH
Router# ssh -l admin 192.168.1.100

# Ping
$ ping 8.8.8.8
$ ping -c 100 8.8.8.8             # 100 packets
$ ping -s 1500 8.8.8.8            # Size 1500 bytes

# Ping from specific interface/IP
$ ping -I eth0 8.8.8.8
$ ping -I 192.168.1.1 8.8.8.8

# Traceroute
$ traceroute 8.8.8.8
$ traceroute -I 8.8.8.8           # Use ICMP
$ tracepath 8.8.8.8               # Alternative

# MTR (better traceroute)
$ mtr 8.8.8.8

# Telnet (test TCP port)
$ telnet 192.168.1.100 80

# Or using netcat
$ nc -zv 192.168.1.100 80

# Or using curl
$ curl -v telnet://192.168.1.100:80

# SSH
$ ssh admin@192.168.1.100

# Interface statistics
Router# show interfaces gi0/0
Router# show interfaces gi0/0 stats

# Error counters
Router# show interfaces gi0/0 | include error
Router# show interfaces gi0/0 | include collision

# Clear counters
Router# clear counters gi0/0

# Interface status reasons
Router# show interfaces status

# SFP/transceiver info
Router# show interfaces gi0/0 transceiver

# Verify cable (if supported)
Router# test cable-diagnostics tdr interface gi0/0
Router# show cable-diagnostics tdr interface gi0/0

# Interface statistics
$ ip -s link show eth0
$ ifconfig eth0                   # Shows errors
$ cat /proc/net/dev               # All interface stats

# Detailed statistics
$ ethtool -S eth0                 # Driver statistics

# Error counters
$ ip -s -s link show eth0 | grep -i error
$ netstat -i                      # Interface statistics

# Clear counters (not typical in Linux)
# Usually done by resetting interface
$ sudo ip link set eth0 down
$ sudo ip link set eth0 up

# Interface info
$ ethtool eth0                    # Speed, duplex, link
$ mii-tool eth0                   # Media info

# SFP/transceiver info
$ ethtool -m eth0                 # Module info

# Cable testing (if supported by NIC)
$ ethtool --cable-test eth0

# Enable debugging (BE CAREFUL IN PRODUCTION!)
Router# debug ip icmp
Router# debug ip routing
Router# debug ip ospf events

# Show active debugs
Router# show debugging

# Disable specific debug
Router# no debug ip icmp

# Disable all debugging
Router# undebug all
Router# no debug all

# Send debug output to terminal
Router# terminal monitor

# Stop debug output to terminal
Router# terminal no monitor

# Conditional debugging (by IP)
Router# debug ip packet 1
Router(config)# access-list 1 permit host 192.168.1.100

# Packet capture (tcpdump)
$ sudo tcpdump -i eth0            # Capture on interface
$ sudo tcpdump -i eth0 icmp       # Only ICMP
$ sudo tcpdump -i eth0 host 192.168.1.100  # Specific host
$ sudo tcpdump -i eth0 port 80    # Specific port

# Save to file
$ sudo tcpdump -i eth0 -w capture.pcap

# Read from file
$ sudo tcpdump -r capture.pcap

# Wireshark (GUI)
$ sudo wireshark

# Monitor routing changes
$ ip monitor route

# Monitor link changes
$ ip monitor link

# System call tracing
$ sudo strace -p PID              # Trace process

# Network tracing
$ sudo ss -tapn                   # Socket statistics
$ sudo netstat -tapn              # Old style

# Real-time traffic monitoring
$ sudo iftop -i eth0              # Interactive
$ sudo iptraf-ng                  # Full-screen

# Protocol-specific
$ sudo tcpdump -i eth0 'tcp port 80'  # HTTP
$ sudo tcpdump -i eth0 'udp port 53'  # DNS

# Enable password (privileged EXEC mode)
Router(config)# enable secret MySecretPass123

# Console password
Router(config)# line console 0
Router(config-line)# password MyConsolePass
Router(config-line)# login

# VTY (Telnet/SSH) password
Router(config)# line vty 0 4
Router(config-line)# password MyVTYPass
Router(config-line)# login

# Encrypt passwords in config
Router(config)# service password-encryption

# Username/password (local authentication)
Router(config)# username admin privilege 15 secret AdminPass123

# Use local database for VTY
Router(config)# line vty 0 4
Router(config-line)# login local

# Change root password
$ sudo passwd root

# Change user password
$ sudo passwd username

# Create user
$ sudo useradd -m username
$ sudo passwd username

# Add user to sudo group
$ sudo usermod -aG sudo username  # Debian/Ubuntu
$ sudo usermod -aG wheel username # RHEL/CentOS

# Lock/unlock account
$ sudo passwd -l username         # Lock
$ sudo passwd -u username         # Unlock

# Password aging
$ sudo chage -M 90 username       # Max 90 days
$ sudo chage -l username          # Show aging info

# SSH key authentication (more secure)
$ ssh-keygen -t rsa -b 4096
$ ssh-copy-id user@remote-host

# Disable password authentication for SSH
$ sudo vim /etc/ssh/sshd_config
PasswordAuthentication no
$ sudo systemctl restart sshd

# Standard ACL (numbered)
Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255
Router(config)# access-list 10 deny any

# Standard ACL (named)
Router(config)# ip access-list standard ALLOW-LAN
Router(config-std-nacl)# permit 192.168.1.0 0.0.0.255
Router(config-std-nacl)# deny any

# Extended ACL (numbered)
Router(config)# access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
Router(config)# access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 443
Router(config)# access-list 100 deny ip any any

# Extended ACL (named)
Router(config)# ip access-list extended WEB-TRAFFIC
Router(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 80
Router(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 443
Router(config-ext-nacl)# deny ip any any

# Apply ACL to interface
Router(config)# interface gi0/0
Router(config-if)# ip access-group 100 in
Router(config-if)# ip access-group ALLOW-LAN out

# View ACLs
Router# show access-lists
Router# show ip access-lists
Router# show access-lists 100

# View ACL on interface
Router# show ip interface gi0/0 | include access list

# iptables rules (filter table)
# Default policies
$ sudo iptables -P INPUT DROP
$ sudo iptables -P FORWARD DROP
$ sudo iptables -P OUTPUT ACCEPT

# Allow established connections
$ sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow from specific network
$ sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

# Allow specific services
$ sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow from specific network to specific service
$ sudo iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 80 -j ACCEPT

# Deny all other
$ sudo iptables -A INPUT -j DROP

# View rules
$ sudo iptables -L -n -v
$ sudo iptables -L INPUT -n -v --line-numbers

# Delete rule by number
$ sudo iptables -D INPUT 5

# Insert rule at specific position
$ sudo iptables -I INPUT 3 -p tcp --dport 8080 -j ACCEPT

# Save rules
$ sudo iptables-save > /etc/iptables/rules.v4
$ sudo netfilter-persistent save

# Restore rules
$ sudo iptables-restore < /etc/iptables/rules.v4

# Using firewalld (RHEL/CentOS)
$ sudo firewall-cmd --zone=public --add-service=http --permanent
$ sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
$ sudo firewall-cmd --reload
$ sudo firewall-cmd --list-all

# Using UFW (Ubuntu - simplified firewall)
$ sudo ufw allow 80/tcp
$ sudo ufw allow 443/tcp
$ sudo ufw allow from 192.168.1.0/24
$ sudo ufw enable
$ sudo ufw status

# Generate RSA keys
Router(config)# crypto key generate rsa
How many bits in the modulus [512]: 2048

# Set domain name (required for SSH)
Router(config)# ip domain-name example.com

# Enable SSH version 2
Router(config)# ip ssh version 2

# Set SSH timeout
Router(config)# ip ssh time-out 60

# Set SSH authentication retries
Router(config)# ip ssh authentication-retries 3

# Configure VTY for SSH only
Router(config)# line vty 0 4
Router(config-line)# transport input ssh
Router(config-line)# login local

# Create user
Router(config)# username admin privilege 15 secret MyPassword

# View SSH status
Router# show ip ssh
Router# show ssh

# SSH server configuration
$ sudo vim /etc/ssh/sshd_config

# Common security settings:
Port 22
PermitRootLogin no
PasswordAuthentication yes
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2

# Use SSH protocol 2 only (default in modern SSH)

# Restart SSH service
$ sudo systemctl restart sshd

# Generate SSH keys for server (done during install usually)
$ sudo ssh-keygen -A

# View SSH service status
$ sudo systemctl status sshd

# View active SSH sessions
$ who
$ w

# View SSH logs
$ sudo tail -f /var/log/auth.log  # Debian/Ubuntu
$ sudo tail -f /var/log/secure    # RHEL/CentOS

# Allow/deny specific users
$ sudo vim /etc/ssh/sshd_config
AllowUsers admin user1 user2
DenyUsers baduser

# SSH key-based authentication (client side)
$ ssh-keygen -t rsa -b 4096
$ ssh-copy-id user@server

# Enable logging
Router(config)# logging on

# Set logging buffer size
Router(config)# logging buffered 16384

# Log to console
Router(config)# logging console

# Log to terminal sessions
Router(config)# logging monitor

# Log to syslog server
Router(config)# logging host 192.168.1.100
Router(config)# logging trap informational

# Logging levels
Router(config)# logging console warnings

# Levels (0-7):
# 0 emergencies
# 1 alerts
# 2 critical
# 3 errors
# 4 warnings
# 5 notifications
# 6 informational
# 7 debugging

# View logs
Router# show logging
Router# show logging | include error

# Clear log
Router# clear logging

# Timestamps on logs
Router(config)# service timestamps log datetime msec
Router(config)# service timestamps debug datetime msec

# Sequence numbers
Router(config)# service sequence-numbers

# SNMP configuration
Router(config)# snmp-server community public RO
Router(config)# snmp-server community private RW
Router(config)# snmp-server host 192.168.1.100 public

# NetFlow for traffic analysis
Router(config)# ip flow-export destination 192.168.1.100 9996
Router(config)# ip flow-export version 5
Router(config)# interface gi0/0
Router(config-if)# ip flow ingress

# Systemd journal (modern logging)
$ journalctl                      # View all logs
$ journalctl -f                   # Follow logs (tail -f)
$ journalctl -u sshd              # Specific service
$ journalctl -p err               # Priority level
$ journalctl --since "1 hour ago"
$ journalctl --since "2025-10-31 14:00"

# Traditional syslog files
$ tail -f /var/log/syslog         # Debian/Ubuntu
$ tail -f /var/log/messages       # RHEL/CentOS
$ tail -f /var/log/auth.log       # Authentication

# Rsyslog configuration (send to remote server)
$ sudo vim /etc/rsyslog.conf
*.* @192.168.1.100:514            # UDP
*.* @@192.168.1.100:514           # TCP

$ sudo systemctl restart rsyslog

# Log rotation
$ sudo vim /etc/logrotate.conf
$ sudo vim /etc/logrotate.d/custom

# SNMP configuration
$ sudo apt install snmpd          # Debian/Ubuntu
$ sudo yum install net-snmp       # RHEL/CentOS

$ sudo vim /etc/snmp/snmpd.conf
rocommunity public 192.168.1.100
rwcommunity private 192.168.1.100

$ sudo systemctl restart snmpd

# NetFlow equivalent (using softflowd)
$ sudo apt install softflowd
$ sudo vim /etc/default/softflowd
INTERFACE=eth0
OPTIONS="-n 192.168.1.100:9996 -v 5"

$ sudo systemctl restart softflowd

# Or using nfdump/nfsen for NetFlow collection

# Real-time monitoring
$ top                             # Process monitor
$ htop                            # Better top
$ iotop                           # I/O monitor
$ iftop                           # Network monitor
$ netstat -s                      # Network statistics
$ ss -s                           # Socket statistics

# Hot Standby Router Protocol
Router1(config)# interface gi0/0
Router1(config-if)# ip address 192.168.1.2 255.255.255.0
Router1(config-if)# standby 1 ip 192.168.1.1
Router1(config-if)# standby 1 priority 110
Router1(config-if)# standby 1 preempt

Router2(config)# interface gi0/0
Router2(config-if)# ip address 192.168.1.3 255.255.255.0
Router2(config-if)# standby 1 ip 192.168.1.1
Router2(config-if)# standby 1 priority 100

# View HSRP status
Router# show standby
Router# show standby brief

# VRRP (alternative to HSRP)
Router(config-if)# vrrp 1 ip 192.168.1.1
Router(config-if)# vrrp 1 priority 110

# GLBP (Gateway Load Balancing Protocol)
Router(config-if)# glbp 1 ip 192.168.1.1
Router(config-if)# glbp 1 priority 110

# Keepalived (VRRP implementation)
$ sudo apt install keepalived

# Master router configuration
$ sudo vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 110
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass mypassword
    }
    virtual_ipaddress {
        192.168.1.1/24
    }
}

# Backup router configuration
$ sudo vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass mypassword
    }
    virtual_ipaddress {
        192.168.1.1/24
    }
}

$ sudo systemctl restart keepalived

# View status
$ ip addr show eth0               # Check for VIP
$ sudo systemctl status keepalived

# Logs
$ sudo journalctl -u keepalived -f

# Alternative: Pacemaker + Corosync (more complex HA)
# Alternative: UCARP (simpler CARP implementation)

# Class-based QoS
Router(config)# class-map match-all VOICE
Router(config-cmap)# match ip dscp ef

Router(config)# class-map match-all VIDEO
Router(config-cmap)# match ip dscp af41

Router(config)# policy-map WAN-POLICY
Router(config-pmap)# class VOICE
Router(config-pmap-c)# priority 256
Router(config-pmap)# class VIDEO
Router(config-pmap-c)# bandwidth 512

Router(config)# interface gi0/1
Router(config-if)# service-policy output WAN-POLICY

# View QoS
Router# show policy-map interface gi0/1

# Traffic control (tc)
# HTB (Hierarchical Token Bucket) example

# Create root qdisc
$ sudo tc qdisc add dev eth0 root handle 1: htb default 30

# Create classes
$ sudo tc class add dev eth0 parent 1: classid 1:1 htb rate 1000mbit
$ sudo tc class add dev eth0 parent 1:1 classid 1:10 htb rate 256kbit ceil 512kbit # Voice
$ sudo tc class add dev eth0 parent 1:1 classid 1:20 htb rate 512kbit ceil 768kbit # Video
$ sudo tc class add dev eth0 parent 1:1 classid 1:30 htb rate 232kbit ceil 1000mbit # Default

# Add filters (DSCP marking)
$ sudo tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 \
    match ip tos 0xb8 0xff flowid 1:10  # DSCP EF (Voice)

$ sudo tc filter add dev eth0 protocol ip parent 1:0 prio 2 u32 \
    match ip tos 0x88 0xff flowid 1:20  # DSCP AF41 (Video)

# View QoS
$ sudo tc -s qdisc show dev eth0
$ sudo tc -s class show dev eth0

# Remove all QoS
$ sudo tc qdisc del dev eth0 root

# Alternative: nftables with QoS
# Alternative: wondershaper (simple bandwidth limiting)

# EEM (Embedded Event Manager) scripts
Router(config)# event manager applet INTERFACE-DOWN
Router(config-applet)# event syslog pattern "Interface GigabitEthernet0/0, changed state to down"
Router(config-applet)# action 1.0 cli command "enable"
Router(config-applet)# action 2.0 cli command "send log Interface went down, investigating"

# TCL scripts
Router# tclsh
Router(tcl)# puts "Hello from TCL"
Router(tcl)# exit

# Python on IOS-XE
Router# guestshell enable
Router# guestshell run python3 script.py

# NETCONF/YANG for programmatic access

# Bash scripts (covered in previous guides!)
$ vim script.sh
#!/bin/bash
# Your automation here

$ chmod +x script.sh
$ ./script.sh

# Python for network automation
$ python3 script.py

# Ansible for network automation
$ ansible-playbook configure-routers.yml

# Common Python libraries for networking:
# - netmiko (SSH to network devices)
# - paramiko (SSH library)
# - napalm (network automation library)
# - pysnmp (SNMP library)

# Example with netmiko
from netmiko import ConnectHandler

device = {
    'device_type': 'cisco_ios',
    'host': '192.168.1.1',
    'username': 'admin',
    'password': 'password',
}

connection = ConnectHandler(**device)
output = connection.send_command('show ip interface brief')
print(output)
connection.disconnect()