Cisco IOS/IOS-XE Configuration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

Where Cisco IOS and IOS-XE sits

Cisco IOS and IOS-XE are the command language of a large share of campus closets and of many branch routers. You enter configuration with configure terminal, you leave it with end, and a change is not in the startup file until you write memory or copy running-config startup-config. People say IOS when they mean this habit. IOS-XE is the same habit on a newer software base. Your show commands and your save command are the ones to confirm on the version you run.

Do not treat NX-OS, IOS-XR, or ASA as this page. NX-OS wants feature commands and a management interface. IOS-XR wants an explicit commit. ASA is a firewall with security levels. Pasting an IOS VLAN stanza onto those boxes is how a maintenance window becomes a syntax error, or worse, a partial paste. The neighbouring pillars exist so you do not have to guess.

Use a lab or the first closet, not the core, for the first week you touch Cisco IOS and IOS-XE. The change window still needs a ticket, a test host, and the rollback above. Automation comes after you can do the boring change by hand and get back. The automation guide is that sequence. This page is the dialect.

Management belongs on a prefix you named, over SSH or the platform's equivalent, from a jump host. The hardening guide is the standard. This page does not open Telnet, does not permit the world, and does not put a password in the clear for you to copy. If a generator shows a placeholder password, replace it before the device is reachable.

A lab change, one step at a time

Step 1 on Cisco IOS and IOS-XE is about the hostname. The lab text is: hostname edge-01 The name is how logs and inventory agree. Set it before you build anything you will have to find later. This is a starter for campus switches and branch routers that still speak the classic IOS CLI. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: Show the running hostname and match it to the ticket.. If the check fails, stop. The way back is: If you have not saved, reload may return the previous startup file, and it also drops traffic. Prefer a tested rollback of the specific lines when the device is in service. In a lab, reload without saving is a blunt instrument you should have used once so you believe it.. Do not type the next step on top of a failed one. Cisco IOS and IOS-XE only keeps a change the way its own save model describes: write memory, or copy running-config startup-config, stores the running configuration.. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into Cisco IOS and IOS-XE.

Step 2 on Cisco IOS and IOS-XE is about a local operator. The lab text is: username netops privilege 15 secret prompt-for-this Privilege 15 is full administrative access. Use a named person where you can, and never leave the placeholder secret. This is a starter for campus switches and branch routers that still speak the classic IOS CLI. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: Log in as that user on a lab VTY and then remove any shared password you only used to get there.. If the check fails, stop. The way back is: If you have not saved, reload may return the previous startup file, and it also drops traffic. Prefer a tested rollback of the specific lines when the device is in service. In a lab, reload without saving is a blunt instrument you should have used once so you believe it.. Do not type the next step on top of a failed one. Cisco IOS and IOS-XE only keeps a change the way its own save model describes: write memory, or copy running-config startup-config, stores the running configuration.. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into Cisco IOS and IOS-XE.

Step 3 on Cisco IOS and IOS-XE is about a management address. The lab text is: interface Vlan1 with 192.0.2.10 255.255.255.0 VLAN 1 is the lab stand-in. In production, move management to the management VLAN from the switching guide and shut unused access on VLAN 1. This is a starter for campus switches and branch routers that still speak the classic IOS CLI. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: Ping the gateway 192.0.2.1 from the switch only after the uplink exists.. If the check fails, stop. The way back is: If you have not saved, reload may return the previous startup file, and it also drops traffic. Prefer a tested rollback of the specific lines when the device is in service. In a lab, reload without saving is a blunt instrument you should have used once so you believe it.. Do not type the next step on top of a failed one. Cisco IOS and IOS-XE only keeps a change the way its own save model describes: write memory, or copy running-config startup-config, stores the running configuration.. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into Cisco IOS and IOS-XE.

Step 4 on Cisco IOS and IOS-XE is about SSH. The lab text is: ip ssh version 2 and transport input ssh Telnet stays off. Restrict the VTY to the management prefix with an access class when you leave the lab. This is a starter for campus switches and branch routers that still speak the classic IOS CLI. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: A Telnet attempt should fail, and SSH from the jump host should succeed.. If the check fails, stop. The way back is: If you have not saved, reload may return the previous startup file, and it also drops traffic. Prefer a tested rollback of the specific lines when the device is in service. In a lab, reload without saving is a blunt instrument you should have used once so you believe it.. Do not type the next step on top of a failed one. Cisco IOS and IOS-XE only keeps a change the way its own save model describes: write memory, or copy running-config startup-config, stores the running configuration.. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into Cisco IOS and IOS-XE.

Step 5 on Cisco IOS and IOS-XE is about a user VLAN. The lab text is: vlan 20 / name Users The VLAN is layer 2. The subnet is a separate plan. Create the VLAN before you assign the port. This is a starter for campus switches and branch routers that still speak the classic IOS CLI. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: Show the VLAN and see that it exists before any host moves.. If the check fails, stop. The way back is: If you have not saved, reload may return the previous startup file, and it also drops traffic. Prefer a tested rollback of the specific lines when the device is in service. In a lab, reload without saving is a blunt instrument you should have used once so you believe it.. Do not type the next step on top of a failed one. Cisco IOS and IOS-XE only keeps a change the way its own save model describes: write memory, or copy running-config startup-config, stores the running configuration.. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into Cisco IOS and IOS-XE.

Step 6 on Cisco IOS and IOS-XE is about an access port. The lab text is: switchport mode access and switchport access vlan 20 on GigabitEthernet1/0/1 An access port carries one VLAN. Portfast is for this edge port only, never for the uplink. This is a starter for campus switches and branch routers that still speak the classic IOS CLI. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: A test host on that port lands in VLAN 20 and nowhere else.. If the check fails, stop. The way back is: If you have not saved, reload may return the previous startup file, and it also drops traffic. Prefer a tested rollback of the specific lines when the device is in service. In a lab, reload without saving is a blunt instrument you should have used once so you believe it.. Do not type the next step on top of a failed one. Cisco IOS and IOS-XE only keeps a change the way its own save model describes: write memory, or copy running-config startup-config, stores the running configuration.. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into Cisco IOS and IOS-XE.

Step 7 on Cisco IOS and IOS-XE is about a static route. The lab text is: ip route 203.0.113.0 255.255.255.0 192.0.2.1 This is a documentation prefix used as a lab destination. Replace it with the real prefix or remove it before production. Do not advertise it. This is a starter for campus switches and branch routers that still speak the classic IOS CLI. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: The longest match for a test address in that prefix is this route, and the next hop answers.. If the check fails, stop. The way back is: If you have not saved, reload may return the previous startup file, and it also drops traffic. Prefer a tested rollback of the specific lines when the device is in service. In a lab, reload without saving is a blunt instrument you should have used once so you believe it.. Do not type the next step on top of a failed one. Cisco IOS and IOS-XE only keeps a change the way its own save model describes: write memory, or copy running-config startup-config, stores the running configuration.. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into Cisco IOS and IOS-XE.

Step 8 on Cisco IOS and IOS-XE is about the save. The lab text is: write memory Until this runs, a reboot drops the lab. After it runs, a reboot keeps the lab, including a mistake you saved. This is a starter for campus switches and branch routers that still speak the classic IOS CLI. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: Show the startup configuration and find the hostname.. If the check fails, stop. The way back is: If you have not saved, reload may return the previous startup file, and it also drops traffic. Prefer a tested rollback of the specific lines when the device is in service. In a lab, reload without saving is a blunt instrument you should have used once so you believe it.. Do not type the next step on top of a failed one. Cisco IOS and IOS-XE only keeps a change the way its own save model describes: write memory, or copy running-config startup-config, stores the running configuration.. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into Cisco IOS and IOS-XE.

configure terminal
hostname edge-01
ip domain name example.com
username netops privilege 15 secret prompt-for-this
interface Vlan1
 ip address 192.0.2.10 255.255.255.0
 no shutdown
ip ssh version 2
line vty 0 4
 login local
 transport input ssh
vlan 20
 name Users
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 20
spanning-tree portfast
ip route 203.0.113.0 255.255.255.0 192.0.2.1
end
write memory
! Review before you paste. Replace prompt-for-this. VLAN 1 is only a lab stand-in.

After the lab is boring

When the lab hostname, the management address, one user VLAN, and one route or one policy all behave, write the rollback and the save command on a card next to the console. The on-call will not reread this pillar at 2 a.m. They will read the card. If the card disagrees with this page, fix the card after you confirm which one matches the software version you run. Versions drift. A command that worked on the previous train may be refused or may mean something narrower.

Back up the configuration once you have saved it the platform's way. Keep that backup off the device. A device you can rebuild from a backup is a device you can harden without fear. A device whose only configuration is the running memory is a device people are afraid to secure, so they leave extra services on. The hardening pass comes after the backup exists, not before.

Compare the generator's draft to this lab before you point the generator at a real site. The draft should be smaller than your wish list. A VLAN, a management restriction, and a route are enough for a first production use. A draft that also turns on every feature the form offered is a draft to trim. The diff is the change. The vendor guide is not a reason to apply every example in one window.

Document the software version, the save command, and the out-of-band path in the same inventory line as the hostname. Migrations fail when that line is missing. The migration guide assumes you can still reach the box when the new path is wrong. Cisco IOS and IOS-XE does not suspend that rule.

Cisco IOS and IOS-XE checks before the first production save

Confirm this before you call the change done: The lab is not the production core. prompt-for-this was replaced and the secret is not in the ticket. Management is limited to a named prefix. The save command on the card matches Cisco IOS and IOS-XE, not a different vendor. A backup exists off the device before you harden it. The test host is in the VLAN you built, and a host outside it was not accidentally included. The rollback was used once in the lab. The generator draft was trimmed to the ticket. No route or policy permits the world as a convenience. Documentation prefixes are gone before production cutover. The software version is written next to the hostname. Out-of-band access was tested. A second person read the allowed VLAN or the policy aloud. And telnet and any wide web management stay off. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.