Cisco Commands

← Older edit

Revision as of 23:51, 3 February 2026 edit 209.87.206.13 (talk) →Port Security ← Older edit		Latest revision as of 01:08, 22 October 2026 edit undo 50.220.241.211 (talk) →Common OSPF Troubleshooting
(98 intermediate revisions by 3 users not shown)
Line 2:		Line 2:
	A quick-reference guide for common Cisco IOS commands on switches and routers.		A quick-reference guide for common Cisco IOS commands on switches and routers.
	----
	== System & Routing Basics ==
	=== Enable IPv4 Routing (Layer 3 Switches) ===
	<pre>
	ip routing
	</pre>
	=== Enable IPv6 Routing (Routers) ===
	<pre>
	ipv6 unicast-routing
	</pre>
	----		----
Line 45:		Line 31:
	== Configuration Files ==		== Configuration Files ==
			=== Erase Configurations ===
			erase startup-config
			delete flash:vlan.dat
	=== Show Configurations ===		=== Show Configurations ===
Line 60:		Line 50:
	<pre>		<pre>
	show run | include {searchterm}		show run | include {searchterm}
			show run | exclude {searchterm}
	show run | begin {searchterm}		show run | begin {searchterm}
	show run | section {section-name}		show run | section {section-name}
Line 75:		Line 66:
	== User Privileges & Security ==		== User Privileges & Security ==
	=== Enter Privileged Mode ===		=== Enter Privileged Mode ("elevate to root") ===
	<pre>		<pre>
	enable		enable
Line 85:		Line 76:
	</pre>		</pre>
	=== Encrypt Plaintext Passwords (Weak Encryption) ===		=== Encrypt Plaintext Passwords (Weak Encryption) ===
			You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7
	<pre>		<pre>
	service password-encryption		service password-encryption
Line 104:		Line 96:
	show ip interface brief | exclude unassigned		show ip interface brief | exclude unassigned
	</pre>		</pre>
	=== Routing Table ===
	<pre>
	show ip route
	</pre>
	----
	== VLAN & Switching ==		== VLAN & Switching ==
Line 169:		Line 154:
	ip ssh version 2		ip ssh version 2
	</pre>		</pre>
			=== Generate RSA Keys (1-liner) ===
			crypto key generate rsa general-keys modulus 1024
	=== Remove RSA Keys ===		=== Remove RSA Keys ===
Line 180:		Line 168:
	</pre>		</pre>
	=== Set Default Gateway ===		=== Set Default Gateway (switch) ===
	<pre>		<pre>
	ip default-gateway 192.168.10.1		ip default-gateway 192.168.10.1
Line 240:		Line 228:
	=== Interface Selection ===		=== Interface Selection ===
			interface vlan 1
			interface fa0/1
			interface range fa0/2-3
			interface range fa0/2-3,g0/1
			=== Enable Interface ===
			no shutdown
			=== Assign IPv4 Address ===
			ip address 192.168.0.1 255.255.255.0
			=== Assign IPv4 Default Gateway (Switch) ===
			ip default-gateway 192.168.0.254
			== Interface IPv6 Configuration ==
			=== Assign IPv6 Address ===
	<pre>		<pre>
	interface vlan 1		ipv6 address 2001:DB8:CAFE:1::1/64
	interface fa0/1
	interface range fa0/2-3
	</pre>		</pre>
	=== Enable Interface ===		=== Assign Link-Local Address ===
	<pre>		<pre>
	no shutdown		ipv6 address fe80::1 link-local
	</pre>		</pre>
	=== Assign IPv4 Address ===		=== Remove IPv6 Addresses ===
	<pre>		<pre>
	ip address 192.168.0.1 255.255.255.0		no ipv6 address 2001:DB8:CAFE:1::1/64
			no ipv6 address
			</pre>
			=== IPv6 ND Other-Config Flag ===
			Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages.
			- When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.
			ipv6 nd other-config-flag
	</pre>		</pre>
Line 268:		Line 279:
	----		----
	== Switchport Configuration ==		== Access / Trunk Switchport Configuration ==
	=== Access Port ===		=== Access Port ===
	<pre>		Configures the interface as an access port and assigns it to VLAN 10.
	switchport mode access		switchport mode access
	switchport access vlan 10		switchport access vlan 10
	</pre>
	=== Trunk Port ===		=== Trunk Port ===
			Configures the interface as a trunk port using 802.1Q encapsulation.
			switchport trunk encapsulation dot1q
			switchport mode trunk
			=== Trunk Allowed VLANs ===
			Specifies which VLANs are allowed to traverse the trunk link.
			switchport trunk allowed vlan 10,20,33,99
			=== Trunk Native VLANs ===
			Sets the native VLAN for untagged traffic on the trunk.
			switchport trunk native vlan 99
			=== Trunk Nonegotiate ===
			Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.
			switchport nonegotiate
			== EtherChannel Configuration ==
			=== Create EtherChannel (LACP Active) ===
			Configures interfaces to actively negotiate EtherChannel using LACP.
			interface range g0/1 - 2
			channel-group 1 mode active
			=== Create EtherChannel (LACP Passive) ===
			Configures interfaces to respond to LACP negotiation.
			interface range g0/1 - 2
			channel-group 1 mode passive
			=== Create EtherChannel (On Mode) ===
			Forces EtherChannel without negotiation protocol.
			interface range g0/1 - 2
			channel-group 1 mode on
			=== Configure Port-Channel as Access Port ===
			Applies access configuration to the logical Port-Channel interface.
			interface port-channel 1
			switchport mode access
			switchport access vlan 10
			=== Configure Port-Channel as Trunk ===
			Applies trunk configuration to the logical Port-Channel interface.
			interface port-channel 1
			switchport trunk encapsulation dot1q
			switchport mode trunk
			=== Verify EtherChannel ===
			Displays EtherChannel status and summary information.
			show etherchannel summary
			=== Verify Port-Channel Interface ===
			Displays detailed information about the Port-Channel interface.
			show interfaces port-channel 1
			== DHCP ==
			=== Configure a DHCP Server on a Cisco Router ===
			Assigns IP addresses automatically to clients on a network.
	<pre>		<pre>
	switchport trunk encapsulation dot1q		ip dhcp excluded-address 192.168.1.1 192.168.1.10
	switchport mode trunk		! Exclude addresses that should not be assigned dynamically
	</pre>
	=== Trunk VLAN Settings ===		ip dhcp pool LAN_POOL
	<pre>		network 192.168.1.0 255.255.255.0
	switchport trunk allowed vlan 10,20,33,99		default-router 192.168.1.1
	switchport trunk native vlan 99		dns-server 8.8.8.8 8.8.4.4
			lease 7
	</pre>		</pre>
	----		* ''excluded-address'': Prevents certain IPs from being assigned (like static IPs for servers or routers).
			* ''network'': Defines the subnet for DHCP clients.
			* ''default-router'': Sets the gateway IP for clients.
			* ''dns-server'': Specifies DNS servers for clients.
			* ''lease'': Duration the IP is valid (in days).
	== IPv6 Interface Configuration ==		=== Configure DHCP Relay (IP Helper) ===
			Forwards DHCP requests from clients to a remote DHCP server.
	=== Assign IPv6 Address ===
	<pre>		<pre>
	ipv6 address 2001:DB8:CAFE:1::1/64		interface GigabitEthernet0/1
			ip address 192.168.1.1 255.255.255.0
			ip helper-address 192.168.2.100
	</pre>		</pre>
	=== Assign Link-Local Address ===		* ''ip helper-address'': IP of the DHCP server to forward requests to.
			* Needed when the server is on a different subnet.
			=== Verify DHCP Status ===
	<pre>		<pre>
	ipv6 address fe80::1 link-local		show ip dhcp binding      ! Shows assigned IP addresses
			show ip dhcp pool        ! Shows pool usage and statistics
			show running-config      ! Check DHCP configuration
	</pre>		</pre>
	=== Remove IPv6 Addresses ===		=== Best Practices ===
	<pre>		* Exclude static IP addresses from DHCP pools.
	no ipv6 address 2001:DB8:CAFE:1::1/64		* Use ''DHCP relay'' when clients and server are on different subnets.
	no ipv6 address		* Monitor DHCP bindings to prevent IP conflicts.
	</pre>
			== Spanning Tree ==
			=== Enable PortFast on an interface ===
			Use PortFast on edge/access ports that connect to end devices.
			interface GigabitEthernet0/1
			spanning-tree portfast
			=== Enable PortFast globally ===
			Enables PortFast on all access ports.
			spanning-tree portfast default
			=== Enable PortFast on a trunk (use with caution) ===
			Only use when the trunk connects to a single end device (not another switch).
			interface GigabitEthernet0/1
			spanning-tree portfast trunk
			=== Verify PortFast status ===
			show spanning-tree interface GigabitEthernet0/1 detail
			=== Disable PortFast on an interface ===
			interface GigabitEthernet0/1
			no spanning-tree portfast
			=== Best Practice: Enable BPDU Guard with PortFast ===
			Shuts down the port if a BPDU is received, protecting against loops.
			Per interface:
			interface GigabitEthernet0/1
			spanning-tree portfast
			spanning-tree bpduguard enable
			Globally:
			spanning-tree portfast default
			spanning-tree bpduguard default
			=== Set the Root Bridge ===
			The root bridge is the central switch in the spanning tree topology. It is chosen based on the lowest bridge priority. A lower priority value increases the likelihood of a switch becoming the root bridge.
			Set priority to influence root bridge selection:
			* The default priority value is **32768** for all switches.
			* Priority is set in increments of **4096**, and this value is added to the VLAN ID (e.g., for VLAN 1, the default bridge priority would be 32768).
			To influence the root bridge selection, change the priority value:
			interface GigabitEthernet0/1
			spanning-tree vlan 1 priority 4096
			(Sets a lower priority value, increasing the likelihood of this switch becoming the root bridge for VLAN 1)
			Set the root bridge for a specific VLAN:
			* To make the current switch the root bridge:
			spanning-tree vlan 1 root primary
			(This automatically sets the priority lower than the default value, typically to 24576, to ensure this switch becomes the root bridge)
			* To make the current switch the backup root bridge:
			spanning-tree vlan 1 root secondary
			(This sets the priority higher than the primary root, typically to 28672, making it the backup root bridge)
			Alternatively, manually set the root bridge priority:
			interface GigabitEthernet0/1
			spanning-tree vlan 1 priority 24576
			(Sets this switch with a higher priority, making it more likely to become the root bridge)
			=== Verify Root Bridge ===
			show spanning-tree vlan 1
			(Shows the current root bridge and its priority, along with other STP details)
			=== Notes ===
			* Do '''not''' enable PortFast on ports connected to other switches (this can cause network loops).
			* PortFast should only be used on access/edge ports that connect to end devices like PCs, printers, or phones.
			* Incorrect use of PortFast can cause Layer 2 loops.
			* The default priority value is **32768**, and it is adjusted in increments of **4096**.
			* Lower priority values increase the likelihood of becoming the root bridge.
			* The priority value combined with the MAC address (if priorities are equal) is used to determine the root bridge.
			== DHCP Snooping ==
			=== Enable DHCP Snooping globally ===
			Enable DHCP Snooping for the switch.
			ip dhcp snooping
			=== Enable DHCP Snooping on a VLAN ===
			DHCP Snooping only operates on specified VLANs.
			ip dhcp snooping vlan 10
			ip dhcp snooping vlan 20
			=== Configure trusted interfaces ===
			Mark uplinks or ports connected to legitimate DHCP servers as trusted.
			interface GigabitEthernet0/1
			ip dhcp snooping trust
			=== Untrusted interfaces (default) ===
			Access ports are untrusted by default. DHCP server responses are blocked.
			interface GigabitEthernet0/2
			no ip dhcp snooping trust
			=== Configure DHCP Snooping rate limiting ===
			Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.
			interface GigabitEthernet0/2
			ip dhcp snooping limit rate 15
			=== Verify DHCP Snooping status ===
			show ip dhcp snooping
			show ip dhcp snooping binding
			=== Disable DHCP Snooping ===
			no ip dhcp snooping
			no ip dhcp snooping vlan 10
			=== Notes ===
			* Only trusted ports can send DHCP server messages
			* Access ports should remain untrusted
			* Commonly used with '''Dynamic ARP Inspection''' and '''IP Source Guard'''
			* Requires correct VLAN configuration to function properly
			== Dynamic ARP Inspection (DAI) ==
			Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.
			=== Enable DAI globally ===
			Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).
			ip arp inspection
			=== Enable DAI on a VLAN ===
			Specify which VLANs should be protected.
			ip arp inspection vlan 10
			ip arp inspection vlan 20
			ip arp inspection vlan 10,20  (alternative: range)
			=== Configure trusted interfaces ===
			Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.
			interface GigabitEthernet0/1
			ip arp inspection trust
			Trusted ports forward ARP packets without validation.
			=== Untrusted interfaces (default) ===
			Access ports are untrusted by default. Invalid ARP packets are dropped.
			interface GigabitEthernet0/2
			no ip arp inspection trust  (optional; this is the default)
			=== Configure ARP rate limiting ===
			Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).
			interface GigabitEthernet0/2
			ip arp inspection limit rate 15  (example: 15 packets per second)
			ip arp inspection limit rate 100 burst interval 1  (optional: higher rate with burst)
			=== Additional Validation Checks ===
			By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).
			ip arp inspection validate src-mac
			ip arp inspection validate src-mac dst-mac ip  (common: enable all three)
			Options:
			* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).
			* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).
			* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.
			Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.
			To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code>
			=== Verify DAI status ===
			show ip arp inspection
			show ip arp inspection vlan 10
			show ip arp inspection interfaces
			show ip arp inspection statistics  (shows drops, rate limit violations)
			show ip arp inspection log  (logs of dropped packets)
			=== Disable DAI ===
			no ip arp inspection
			no ip arp inspection vlan 10
	----		=== Notes ===
			* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).
			* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).
			* Access ports should remain '''untrusted''' to enforce checks.
			* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.
			* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.
			* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.
			* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.
			* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.
			* DAI is ingress-only (checks incoming packets on untrusted ports).
	== Port Security ==		== Port Security ==
			=== View status of port security on an interface ===
			show port-security interface f0/1
	=== Activate Port Security on an interface ===		=== Activate Port Security on an interface ===
Line 317:		Line 596:
	Enable Port Security		Enable Port Security
	switchport port-security		switchport port-security
			=== Set the maximum number of mac addresses that can be used on that port ===
			switchport port-security maximum 1
			=== Whitelist a specific mac address ===
			switchport port-security mac-address 0001.6311.E7BC
			=== Enable sticky mode to automatically learn mac addresses ===
			switchport port-security mac-address sticky
			=== Port Security Violation Modes ===
			==== Protect ====
			Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.
			switchport port-security violation protect
			==== Restrict ====
			Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.
			switchport port-security violation restrict
			==== Shutdown ====
			Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.
			switchport port-security violation shutdown
			=== Port Security Aging ===
			==== Enable static aging on an interface ====
			switchport port-security aging static
			==== Enable timed aging on an interface (5 minutes) ====
			switchport port-security aging time 5
			= Routing =
			Routing is the process of forwarding packets between different networks using routing tables and routing protocols.
			=== Enable IP Routing (Layer 3 Switch) ===
			Required on multilayer switches to allow routing between VLANs.
			ip routing
			=== Enable IPv6 Routing (Routers) ===
			ipv6 unicast-routing
			== Static Routing ==
			=== Configure a Static Route ===
			Manually define a path to a remote network. Here's an example using the default administrative distance value.
			ip route 192.168.2.0 255.255.255.0 192.168.1.1
			Manually define a path to a remote network and specify the administrative distance.
			ip route 192.168.2.0 255.255.255.0 192.168.1.1 10
			Format:
			ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative-distance (optional)>
			=== Configure a Fully Specified Static Route ===
			A fully specified static route includes both the next-hop IP address and the exit interface. This is commonly used on multi-access networks.
			Example:
			ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1
			You can also specify the administrative distance:
			ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1 10
			Format:
			ip route <destination-network> <subnet-mask> <exit-interface> <next-hop-ip> <administrative-distance (optional)>
			=== Configure a Default Route / Default Gateway ===
			Route used when no specific route matches the destination.
			ip route 0.0.0.0 0.0.0.0 192.168.1.1
			ipv6 route ::/0 2001:ABC:33:44::1
			== Administrative Distance ==
			Determines which route is preferred when multiple routes to the same destination exist.
			Common values:
			Connected – 0
			Static – 1
			EIGRP – 90
			OSPF – 110
			RIP – 120
			Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances
			{| class="wikitable" style="text-align:center"
			! Routing protocol !! Administrative distance
			|-
			| Directly connected interface || 0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)
			|-
			| Static route || 1
			|-
			| Dynamic Mobile Network Routing (DMNR) || 3
			|-
			| EIGRP summary route || 5
			|-
			| External BGP || 20
			|-
			| EIGRP internal route || 90
			|-
			| IGRP || 100
			|-
			| Open Shortest Path First (OSPF) || 110
			|-
			| Intermediate System to Intermediate System (IS-IS) || 115
			|-
			| Routing Information Protocol (RIP) || 120
			|-
			| Exterior Gateway Protocol (EGP) || 140
			|-
			| On Demand Routing (ODR) || 160
			|-
			| EIGRP external route || 170
			|-
			| Internal BGP || 200
			|-
			| Next Hop Resolution Protocol (NHRP) || 250
			|-
			| Default static route learned via DHCP || 254
			|-
			| Unknown and unused || 255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)
			|}
			== Dynamic Routing ==
			Dynamic routing protocols automatically exchange routing information between routers.
			=== Configure RIP v2 ===
			Uses hop count as metric (maximum 15 hops).
			router rip
			version 2
			no auto-summary
			network 192.168.1.0
			=== Configure EIGRP ===
			Uses bandwidth and delay as composite metric.
			router eigrp 100
			no auto-summary
			network 192.168.1.0 0.0.0.255
			=== Configure OSPF ===
			Open Shortest Path First (OSPF) is a link-state routing protocol that uses cost as its metric. OSPF routers exchange link-state advertisements (LSAs) to build a link-state database (LSDB) and use the Dijkstra shortest-path-first (SPF) algorithm to calculate the best routes.
			==== Basic OSPF Configuration ====
			OSPFv2 is used for IPv4 routing. The process ID is locally significant, meaning it does not have to match between routers.
			router ospf 1
			network 192.168.1.0 0.0.0.255 area 0
			<code>router ospf 1</code> — Starts OSPF process 1.
			<code>network</code> — Identifies interfaces that participate in OSPF based on their IP addresses.
			<code>0.0.0.255</code> — Wildcard mask matching the 192.168.1.0/24 network.
			<code>area 0</code> — Places matching interfaces in OSPF backbone area 0.
			==== OSPF Router ID ====
			The router ID (RID) is a 32-bit value written in IPv4 address format. It uniquely identifies an OSPF router within the OSPF routing domain.
			===== Router ID Selection =====
			If a router ID is not manually configured, Cisco IOS selects one using the following rules when OSPF starts:
			*Use the highest IPv4 address configured on any active loopback interface.
			*If no active loopback interface has an IPv4 address, use the highest IPv4 address on an active physical interface.
			A manually configured router ID takes precedence over automatic selection.
			===== Configure a Router ID =====
			router ospf 1
			router-id 1.1.1.1
			The router ID does not need to be an address assigned to a physical interface.
			Each router in the same OSPF routing domain should have a unique router ID.
			Changing the router ID after OSPF has started may require restarting the OSPF process for the change to take effect.
			===== Configure a Loopback Interface =====
			A loopback interface is a logical interface that remains up as long as it is administratively enabled and the router is operational.
			interface loopback 0
			ip address 10.10.10.10 255.255.255.255
			A loopback interface can provide a stable address for automatic router ID selection. A manually configured router ID is another common option.
			==== OSPF Network Statements and Wildcard Masks ====
			OSPF network statements use wildcard masks to determine which interface IP addresses match the statement. Matching interfaces are enabled for OSPF in the specified area.
			Examples:
			network 192.168.1.0 0.0.0.255 area 0
			network 10.0.0.0 0.255.255.255 area 0
			network 172.16.1.1 0.0.0.0 area 0
			'''0.0.0.255''' — Matches the first 24 bits of the address.
			'''0.255.255.255''' — Matches addresses with the first octet set to 10.
			'''0.0.0.0''' — Matches one exact interface IP address.
			A wildcard mask is the inverse of a subnet mask. Subtract each subnet mask octet from 255 to obtain the corresponding wildcard mask.
			==== OSPF Passive Interfaces ====
			A passive interface advertises its network through OSPF but does not send OSPF hello packets or form OSPF neighbor adjacencies on that interface. This is useful for LANs that contain end devices rather than other routers.
			router ospf 1
			passive-interface gigabitEthernet 0/0
			To make all interfaces passive by default and selectively enable OSPF neighbor formation on router links:
			router ospf 1
			passive-interface default
			no passive-interface gigabitEthernet 0/1
			==== OSPF Cost and Reference Bandwidth ====
			OSPF uses cost to determine the best path. Lower total cost is preferred.
			Cost = Reference Bandwidth / Interface Bandwidth
			The default reference bandwidth on many Cisco IOS platforms is 100 Mbps. With this default, faster interfaces may receive the same cost, so the reference bandwidth should be adjusted consistently across routers when appropriate.
			router ospf 1
			auto-cost reference-bandwidth 1000
			This example sets the reference bandwidth to 1000 Mbps (1 Gbps). The value is expressed in Mbps.
			An interface cost can also be configured manually:
			interface gigabitEthernet 0/1
			ip ospf cost 10
			The manually configured cost overrides the calculated cost for that interface.
			==== OSPF Areas ====
			OSPF divides a routing domain into areas to improve scalability and reduce the amount of routing information that must be processed by each router.
			*'''Area 0''' — The backbone area.
			*'''Internal router''' — Has all OSPF interfaces within the same area.
			*'''Backbone router''' — Has at least one interface in area 0.
			*'''Area Border Router (ABR)''' — Connects multiple OSPF areas.
			*'''Autonomous System Boundary Router (ASBR)''' — Redistributes routes from another routing source into OSPF.
			In a multiarea OSPF design, non-backbone areas must connect to area 0 logically, directly or through a supported virtual link.
			==== OSPF Neighbor Adjacencies ====
			OSPF routers use hello packets to discover neighbors and maintain adjacencies. Routers on a shared link generally need compatible OSPF settings to become neighbors.
			Important parameters include:
			* Area ID
			* Hello and dead intervals
			* Authentication settings, if configured
			* Subnet and network compatibility
			* OSPF area type
			* Unique router IDs
			On broadcast networks, routers elect a Designated Router (DR) and Backup Designated Router (BDR) to reduce adjacency overhead. A point-to-point link does not elect a DR or BDR.
			==== OSPF Network Types ====
			Common OSPF network types include:
			*'''Broadcast''' — Common on Ethernet LANs; supports DR/BDR elections.
			*'''Point-to-point''' — Common on direct router-to-router links; no DR/BDR election.
			*'''Nonbroadcast multiaccess (NBMA)''' — Supports multiple routers without the usual broadcast behavior.
			The network type affects neighbor discovery and adjacency behavior.
			==== OSPF Default Route Advertisement ====
			A router with a valid default route can advertise it into OSPF so other routers can use it to reach destinations that are not otherwise in their routing tables.
			router ospf 1
			default-information originate
			By default, this advertises a default route when one exists in the local routing table. The '''always''' keyword can be used to advertise the default route even when one is not present, but this should be used carefully.
			==== Verify OSPF ====
			Use these commands to troubleshoot OSPF and confirm that routes and adjacencies are working.
			show ip protocols
			show ip ospf
			show ip ospf neighbor
			show ip ospf interface brief
			show ip ospf interface
			show ip ospf database
			show ip route ospf
			show ip route
			<code>show ip protocols</code> — Displays routing protocol settings, including OSPF configuration.
			<code>show ip ospf</code> — Displays OSPF process information, including the router ID.
			<code>show ip ospf neighbor</code> — Shows discovered neighbors and adjacency states.
			<code>show ip ospf interface brief</code> — Summarizes OSPF-enabled interfaces and areas.
			<code>show ip ospf interface</code> — Displays interface-level OSPF details, including cost and timers.
			<code>show ip ospf database</code> — Displays the link-state database.
			<code>show ip route ospf</code> — Displays routes learned through OSPF.
			<code>show ip route</code> — Displays the complete routing table.
			==== Common OSPF Troubleshooting ====
			If OSPF neighbors or routes are missing, check the following:
			* Verify that the correct interfaces have IP addresses and are up.
			* Verify that OSPF is enabled on the intended interfaces.
			* Check the area ID and hello/dead timers.
			* Verify that router IDs are unique.
			* Check passive*interface configuration.
			* Verify that the interfaces use compatible OSPF network types and authentication settings.
			* Confirm that the required networks are advertised.
			* Check interface costs and the routing table.
			* Confirm that area 0 connectivity is correct in multiarea configurations.
			==== OSPFv2 and OSPFv3 ====
			*'''OSPFv2''' — Used for IPv4 routing.
			*'''OSPFv3''' — Originally designed for IPv6 routing and also supports address-family extensions for IPv4 on supported platforms.
			IPv6 OSPFv3 configuration differs from OSPFv2. Interface-level commands and address-family configuration depend on the Cisco IOS version and platform.
			== Route Summarization ==
			Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.
			Example networks:
			192.168.0.0/24
			192.168.1.0/24
			192.168.2.0/24
			192.168.3.0/24
			Can be summarized as:
			192.168.0.0/22
			=== Configure Manual Summarization (EIGRP) ===
			Applied on the outgoing interface.
			interface GigabitEthernet0/0
			ip summary-address eigrp 100 192.168.0.0 255.255.252.0
			=== Configure Manual Summarization (OSPF ABR) ===
			Configured under the OSPF process (on an ABR).
			router ospf 1
			area 0 range 192.168.0.0 255.255.252.0
			== Show Routing Information ==
			=== View Routing Table ===
			show ip route
			=== View Specific Route ===
			show ip route 192.168.1.0
			=== View Routing Protocol Information ===
			show ip protocols

---

Latest revision as of 01:08, 22 October 2026

Cisco IOS Command Reference

A quick-reference guide for common Cisco IOS commands on switches and routers.

---

Device & System Information

Show MAC Address Table

show mac address-table

Show OS and Device Version

show version

Show Logged-in Users

show users

Show Files

dir
dir nvram:

---

Configuration Files

Erase Configurations

erase startup-config
delete flash:vlan.dat

Show Configurations

show running-config
show startup-config

Show Interface Config

show run interface g0/0

Filter Running Config (grep-like)

show run | include {searchterm}
show run | exclude {searchterm}
show run | begin {searchterm}
show run | section {section-name}

Save Running Config

copy running-config startup-config
copy run start
wr

---

User Privileges & Security

Enter Privileged Mode ("elevate to root")

enable

Set Encrypted Enable Password

enable secret ThisisaSecret

Encrypt Plaintext Passwords (Weak Encryption)

You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7

service password-encryption

---

Interface & Network Status

Interface IP Summary

show ip interface brief
show ipv6 interface brief

Interface IP Summary (filtered to only interfaces with IPs)

show ip interface brief | exclude unassigned

VLAN & Switching

Show VLANs

show vlan brief

Show Interface VLAN Details

show interface g0/1 switchport

Show Trunk Interfaces

show int trunk

Clear Tables

clear mac address-table
clear arp-cache

---

Telnet & Remote Access

Connect via Telnet

connect {DeviceName}

Show Hosts & Sessions

show hosts
show sessions

Disconnect Session

disconnect {DeviceName}

Suspend Active Session

Ctrl+Shift+6, then x

---

SSH Configuration

Basic SSH Setup

ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2

Generate RSA Keys (1-liner)

crypto key generate rsa general-keys modulus 1024

Remove RSA Keys

crypto key zeroize rsa

Create Local User

username admin secret ccna

Set Default Gateway (switch)

ip default-gateway 192.168.10.1

Enable SSH on VTY Lines

line vty 0 15
 transport input ssh
 login local
 exit

---

Global Configuration Mode

Enter Global Config

configure terminal

Disable DNS Lookup on Typos

no ip domain-lookup

Set MOTD Banner

banner motd MESSAGEHERE

Set Hostname

hostname HOSTNAME

---

Line Configuration

Console Line

line con 0
 password itsasecret
 login

VTY Lines

line vty 0 15
 password itsasecret
 login

---

Interface Configuration

Interface Selection

interface vlan 1
interface fa0/1
interface range fa0/2-3
interface range fa0/2-3,g0/1

Enable Interface

no shutdown

Assign IPv4 Address

ip address 192.168.0.1 255.255.255.0

Assign IPv4 Default Gateway (Switch)

ip default-gateway 192.168.0.254

Interface IPv6 Configuration

Assign IPv6 Address

ipv6 address 2001:DB8:CAFE:1::1/64

Assign Link-Local Address

ipv6 address fe80::1 link-local

Remove IPv6 Addresses

no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address

IPv6 ND Other-Config Flag

Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. - When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

ipv6 nd other-config-flag

---

VLAN Configuration

Create / Configure VLAN

vlan 10
 name MyAwesomeVlan

---

Access / Trunk Switchport Configuration

Access Port

Configures the interface as an access port and assigns it to VLAN 10.

switchport mode access
switchport access vlan 10

Trunk Port

Configures the interface as a trunk port using 802.1Q encapsulation.

switchport trunk encapsulation dot1q
switchport mode trunk

Trunk Allowed VLANs

Specifies which VLANs are allowed to traverse the trunk link.

switchport trunk allowed vlan 10,20,33,99

Trunk Native VLANs

Sets the native VLAN for untagged traffic on the trunk.

switchport trunk native vlan 99

Trunk Nonegotiate

Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.

switchport nonegotiate

EtherChannel Configuration

Create EtherChannel (LACP Active)

Configures interfaces to actively negotiate EtherChannel using LACP.

interface range g0/1 - 2
 channel-group 1 mode active

Create EtherChannel (LACP Passive)

Configures interfaces to respond to LACP negotiation.

interface range g0/1 - 2
 channel-group 1 mode passive

Create EtherChannel (On Mode)

Forces EtherChannel without negotiation protocol.

interface range g0/1 - 2
 channel-group 1 mode on

Configure Port-Channel as Access Port

Applies access configuration to the logical Port-Channel interface.

interface port-channel 1
 switchport mode access
 switchport access vlan 10

Configure Port-Channel as Trunk

Applies trunk configuration to the logical Port-Channel interface.

interface port-channel 1
 switchport trunk encapsulation dot1q
 switchport mode trunk

Verify EtherChannel

Displays EtherChannel status and summary information.

show etherchannel summary

Verify Port-Channel Interface

Displays detailed information about the Port-Channel interface.

show interfaces port-channel 1

DHCP

Configure a DHCP Server on a Cisco Router

Assigns IP addresses automatically to clients on a network.

ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 8.8.8.8 8.8.4.4
 lease 7

• excluded-address: Prevents certain IPs from being assigned (like static IPs for servers or routers).
• network: Defines the subnet for DHCP clients.
• default-router: Sets the gateway IP for clients.
• dns-server: Specifies DNS servers for clients.
• lease: Duration the IP is valid (in days).

Configure DHCP Relay (IP Helper)

Forwards DHCP requests from clients to a remote DHCP server.

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip helper-address 192.168.2.100

• ip helper-address: IP of the DHCP server to forward requests to.
• Needed when the server is on a different subnet.

Verify DHCP Status

show ip dhcp binding      ! Shows assigned IP addresses
show ip dhcp pool         ! Shows pool usage and statistics
show running-config       ! Check DHCP configuration

Best Practices

• Exclude static IP addresses from DHCP pools.
• Use DHCP relay when clients and server are on different subnets.
• Monitor DHCP bindings to prevent IP conflicts.

Spanning Tree

Enable PortFast on an interface

Use PortFast on edge/access ports that connect to end devices.

interface GigabitEthernet0/1
 spanning-tree portfast

Enable PortFast globally

Enables PortFast on all access ports.

spanning-tree portfast default

Enable PortFast on a trunk (use with caution)

Only use when the trunk connects to a single end device (not another switch).

interface GigabitEthernet0/1
 spanning-tree portfast trunk

Verify PortFast status

show spanning-tree interface GigabitEthernet0/1 detail

Disable PortFast on an interface

interface GigabitEthernet0/1
 no spanning-tree portfast

Best Practice: Enable BPDU Guard with PortFast

Shuts down the port if a BPDU is received, protecting against loops.

Per interface:

interface GigabitEthernet0/1
 spanning-tree portfast
 spanning-tree bpduguard enable

Globally:

spanning-tree portfast default
spanning-tree bpduguard default

Set the Root Bridge

The root bridge is the central switch in the spanning tree topology. It is chosen based on the lowest bridge priority. A lower priority value increases the likelihood of a switch becoming the root bridge.

Set priority to influence root bridge selection:

• The default priority value is **32768** for all switches.
• Priority is set in increments of **4096**, and this value is added to the VLAN ID (e.g., for VLAN 1, the default bridge priority would be 32768).

To influence the root bridge selection, change the priority value:

interface GigabitEthernet0/1
 spanning-tree vlan 1 priority 4096
 (Sets a lower priority value, increasing the likelihood of this switch becoming the root bridge for VLAN 1)

Set the root bridge for a specific VLAN:

• To make the current switch the root bridge:

spanning-tree vlan 1 root primary
 (This automatically sets the priority lower than the default value, typically to 24576, to ensure this switch becomes the root bridge)

• To make the current switch the backup root bridge:

spanning-tree vlan 1 root secondary
 (This sets the priority higher than the primary root, typically to 28672, making it the backup root bridge)

Alternatively, manually set the root bridge priority:

interface GigabitEthernet0/1
 spanning-tree vlan 1 priority 24576
 (Sets this switch with a higher priority, making it more likely to become the root bridge)

Verify Root Bridge

show spanning-tree vlan 1
(Shows the current root bridge and its priority, along with other STP details)

Notes

• Do not enable PortFast on ports connected to other switches (this can cause network loops).
• PortFast should only be used on access/edge ports that connect to end devices like PCs, printers, or phones.
• Incorrect use of PortFast can cause Layer 2 loops.
• The default priority value is **32768**, and it is adjusted in increments of **4096**.
• Lower priority values increase the likelihood of becoming the root bridge.
• The priority value combined with the MAC address (if priorities are equal) is used to determine the root bridge.

DHCP Snooping

Enable DHCP Snooping globally

Enable DHCP Snooping for the switch.

ip dhcp snooping

Enable DHCP Snooping on a VLAN

DHCP Snooping only operates on specified VLANs.

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

Configure trusted interfaces

Mark uplinks or ports connected to legitimate DHCP servers as trusted.

interface GigabitEthernet0/1
 ip dhcp snooping trust

Untrusted interfaces (default)

Access ports are untrusted by default. DHCP server responses are blocked.

interface GigabitEthernet0/2
 no ip dhcp snooping trust

Configure DHCP Snooping rate limiting

Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

interface GigabitEthernet0/2
 ip dhcp snooping limit rate 15

Verify DHCP Snooping status

show ip dhcp snooping
show ip dhcp snooping binding

Disable DHCP Snooping

no ip dhcp snooping
no ip dhcp snooping vlan 10

Notes

• Only trusted ports can send DHCP server messages
• Access ports should remain untrusted
• Commonly used with Dynamic ARP Inspection and IP Source Guard
• Requires correct VLAN configuration to function properly

Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.

Enable DAI globally

Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).

ip arp inspection

Enable DAI on a VLAN

Specify which VLANs should be protected.

ip arp inspection vlan 10
ip arp inspection vlan 20
ip arp inspection vlan 10,20   (alternative: range)

Configure trusted interfaces

Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.

interface GigabitEthernet0/1
 ip arp inspection trust

Trusted ports forward ARP packets without validation.

Untrusted interfaces (default)

Access ports are untrusted by default. Invalid ARP packets are dropped.

interface GigabitEthernet0/2
 no ip arp inspection trust   (optional; this is the default)

Configure ARP rate limiting

Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).

interface GigabitEthernet0/2
 ip arp inspection limit rate 15   (example: 15 packets per second)
 ip arp inspection limit rate 100 burst interval 1   (optional: higher rate with burst)

Additional Validation Checks

By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).

ip arp inspection validate src-mac
ip arp inspection validate src-mac dst-mac ip   (common: enable all three)

Options:

• src-mac — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).
• dst-mac — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).
• ip — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.

Each new ip arp inspection validate command overrides previous ones, so specify all desired options together.

To disable: no ip arp inspection validate [src-mac] [dst-mac] [ip]

Verify DAI status

show ip arp inspection
show ip arp inspection vlan 10
show ip arp inspection interfaces
show ip arp inspection statistics   (shows drops, rate limit violations)
show ip arp inspection log   (logs of dropped packets)

Disable DAI

no ip arp inspection
no ip arp inspection vlan 10

Notes

• Requires DHCP Snooping to build the ARP binding table (enable with ip dhcp snooping + ip dhcp snooping vlan ...).
• Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).
• Access ports should remain untrusted to enforce checks.
• Commonly deployed with PortFast + BPDU Guard on access ports for loop/spanning-tree protection.
• For non-DHCP environments, use static ARP ACLs: ip arp inspection filter arp-acl-name vlan 10.
• Often combined with IP Source Guard (ip verify source) on access ports to filter IP traffic based on the same bindings.
• Rate limiting helps prevent DoS; monitor with show ip arp inspection statistics and consider errdisable recovery cause arp-inspection for automatic port recovery.
• Additional validation (src-mac, dst-mac, ip) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least src-mac and ip in most production setups.
• DAI is ingress-only (checks incoming packets on untrusted ports).

Port Security

View status of port security on an interface

show port-security interface f0/1

Activate Port Security on an interface

The port cannot be a dynamic port:

switchport mode access

Enable Port Security

switchport port-security

Set the maximum number of mac addresses that can be used on that port

switchport port-security maximum 1

Whitelist a specific mac address

switchport port-security mac-address 0001.6311.E7BC

Enable sticky mode to automatically learn mac addresses

switchport port-security mac-address sticky

Port Security Violation Modes

Protect

Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.

switchport port-security violation protect

Restrict

Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.

switchport port-security violation restrict

Shutdown

Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.

switchport port-security violation shutdown

Port Security Aging

Enable static aging on an interface

switchport port-security aging static

Enable timed aging on an interface (5 minutes)

switchport port-security aging time 5

Routing

Routing is the process of forwarding packets between different networks using routing tables and routing protocols.

Enable IP Routing (Layer 3 Switch)

Required on multilayer switches to allow routing between VLANs.

ip routing

Enable IPv6 Routing (Routers)

ipv6 unicast-routing

Static Routing

Configure a Static Route

Manually define a path to a remote network. Here's an example using the default administrative distance value.

ip route 192.168.2.0 255.255.255.0 192.168.1.1

Manually define a path to a remote network and specify the administrative distance.

ip route 192.168.2.0 255.255.255.0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative-distance (optional)>

Configure a Fully Specified Static Route

A fully specified static route includes both the next-hop IP address and the exit interface. This is commonly used on multi-access networks.

Example:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1

You can also specify the administrative distance:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <exit-interface> <next-hop-ip> <administrative-distance (optional)>

Configure a Default Route / Default Gateway

Route used when no specific route matches the destination.

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ipv6 route ::/0 2001:ABC:33:44::1

Administrative Distance

Determines which route is preferred when multiple routes to the same destination exist.

Common values:

Connected – 0
Static – 1
EIGRP – 90
OSPF – 110
RIP – 120

Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances

Routing protocol	Administrative distance
Directly connected interface	0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)
Static route	1
Dynamic Mobile Network Routing (DMNR)	3
EIGRP summary route	5
External BGP	20
EIGRP internal route	90
IGRP	100
Open Shortest Path First (OSPF)	110
Intermediate System to Intermediate System (IS-IS)	115
Routing Information Protocol (RIP)	120
Exterior Gateway Protocol (EGP)	140
On Demand Routing (ODR)	160
EIGRP external route	170
Internal BGP	200
Next Hop Resolution Protocol (NHRP)	250
Default static route learned via DHCP	254
Unknown and unused	255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)

Dynamic Routing

Dynamic routing protocols automatically exchange routing information between routers.

Configure RIP v2

Uses hop count as metric (maximum 15 hops).

router rip
 version 2
 no auto-summary
 network 192.168.1.0

Configure EIGRP

Uses bandwidth and delay as composite metric.

router eigrp 100
 no auto-summary
 network 192.168.1.0 0.0.0.255

Configure OSPF

Open Shortest Path First (OSPF) is a link-state routing protocol that uses cost as its metric. OSPF routers exchange link-state advertisements (LSAs) to build a link-state database (LSDB) and use the Dijkstra shortest-path-first (SPF) algorithm to calculate the best routes.

Basic OSPF Configuration

OSPFv2 is used for IPv4 routing. The process ID is locally significant, meaning it does not have to match between routers.

router ospf 1 
network 192.168.1.0 0.0.0.255 area 0

router ospf 1 — Starts OSPF process 1.

network — Identifies interfaces that participate in OSPF based on their IP addresses.

0.0.0.255 — Wildcard mask matching the 192.168.1.0/24 network.

area 0 — Places matching interfaces in OSPF backbone area 0.

OSPF Router ID

The router ID (RID) is a 32-bit value written in IPv4 address format. It uniquely identifies an OSPF router within the OSPF routing domain.

Router ID Selection

If a router ID is not manually configured, Cisco IOS selects one using the following rules when OSPF starts:

• Use the highest IPv4 address configured on any active loopback interface.
• If no active loopback interface has an IPv4 address, use the highest IPv4 address on an active physical interface.

A manually configured router ID takes precedence over automatic selection.

Configure a Router ID

router ospf 1 
router-id 1.1.1.1

The router ID does not need to be an address assigned to a physical interface. Each router in the same OSPF routing domain should have a unique router ID. Changing the router ID after OSPF has started may require restarting the OSPF process for the change to take effect.

Configure a Loopback Interface

A loopback interface is a logical interface that remains up as long as it is administratively enabled and the router is operational.

interface loopback 0 
ip address 10.10.10.10 255.255.255.255

A loopback interface can provide a stable address for automatic router ID selection. A manually configured router ID is another common option.

OSPF Network Statements and Wildcard Masks

OSPF network statements use wildcard masks to determine which interface IP addresses match the statement. Matching interfaces are enabled for OSPF in the specified area.

Examples:

network 192.168.1.0 0.0.0.255 area 0 
network 10.0.0.0 0.255.255.255 area 0 
network 172.16.1.1 0.0.0.0 area 0

0.0.0.255 — Matches the first 24 bits of the address. 0.255.255.255 — Matches addresses with the first octet set to 10. 0.0.0.0 — Matches one exact interface IP address.

A wildcard mask is the inverse of a subnet mask. Subtract each subnet mask octet from 255 to obtain the corresponding wildcard mask.

OSPF Passive Interfaces

A passive interface advertises its network through OSPF but does not send OSPF hello packets or form OSPF neighbor adjacencies on that interface. This is useful for LANs that contain end devices rather than other routers.

router ospf 1 
passive-interface gigabitEthernet 0/0

To make all interfaces passive by default and selectively enable OSPF neighbor formation on router links:

router ospf 1 
passive-interface default 
no passive-interface gigabitEthernet 0/1

OSPF Cost and Reference Bandwidth

OSPF uses cost to determine the best path. Lower total cost is preferred.

Cost = Reference Bandwidth / Interface Bandwidth

The default reference bandwidth on many Cisco IOS platforms is 100 Mbps. With this default, faster interfaces may receive the same cost, so the reference bandwidth should be adjusted consistently across routers when appropriate.

router ospf 1 
auto-cost reference-bandwidth 1000

This example sets the reference bandwidth to 1000 Mbps (1 Gbps). The value is expressed in Mbps.

An interface cost can also be configured manually:

interface gigabitEthernet 0/1 
ip ospf cost 10

The manually configured cost overrides the calculated cost for that interface.

OSPF Areas

OSPF divides a routing domain into areas to improve scalability and reduce the amount of routing information that must be processed by each router.

• Area 0 — The backbone area.
• Internal router — Has all OSPF interfaces within the same area.
• Backbone router — Has at least one interface in area 0.
• Area Border Router (ABR) — Connects multiple OSPF areas.
• Autonomous System Boundary Router (ASBR) — Redistributes routes from another routing source into OSPF.

In a multiarea OSPF design, non-backbone areas must connect to area 0 logically, directly or through a supported virtual link.

OSPF Neighbor Adjacencies

OSPF routers use hello packets to discover neighbors and maintain adjacencies. Routers on a shared link generally need compatible OSPF settings to become neighbors.

Important parameters include:

• Area ID
• Hello and dead intervals
• Authentication settings, if configured
• Subnet and network compatibility
• OSPF area type
• Unique router IDs

On broadcast networks, routers elect a Designated Router (DR) and Backup Designated Router (BDR) to reduce adjacency overhead. A point-to-point link does not elect a DR or BDR.

OSPF Network Types

Common OSPF network types include:

• Broadcast — Common on Ethernet LANs; supports DR/BDR elections.

• Point-to-point — Common on direct router-to-router links; no DR/BDR election.

• Nonbroadcast multiaccess (NBMA) — Supports multiple routers without the usual broadcast behavior.

The network type affects neighbor discovery and adjacency behavior.

OSPF Default Route Advertisement

A router with a valid default route can advertise it into OSPF so other routers can use it to reach destinations that are not otherwise in their routing tables.

router ospf 1 
default-information originate

By default, this advertises a default route when one exists in the local routing table. The always keyword can be used to advertise the default route even when one is not present, but this should be used carefully.

Verify OSPF

Use these commands to troubleshoot OSPF and confirm that routes and adjacencies are working.

show ip protocols 
show ip ospf 
show ip ospf neighbor 
show ip ospf interface brief 
show ip ospf interface 
show ip ospf database 
show ip route ospf 
show ip route

show ip protocols — Displays routing protocol settings, including OSPF configuration.

show ip ospf — Displays OSPF process information, including the router ID.

show ip ospf neighbor — Shows discovered neighbors and adjacency states.

show ip ospf interface brief — Summarizes OSPF-enabled interfaces and areas.

show ip ospf interface — Displays interface-level OSPF details, including cost and timers.

show ip ospf database — Displays the link-state database.

show ip route ospf — Displays routes learned through OSPF.

show ip route — Displays the complete routing table.

Common OSPF Troubleshooting

If OSPF neighbors or routes are missing, check the following:

• Verify that the correct interfaces have IP addresses and are up.

• Verify that OSPF is enabled on the intended interfaces.

• Check the area ID and hello/dead timers.

• Verify that router IDs are unique.

• Check passive*interface configuration.

• Verify that the interfaces use compatible OSPF network types and authentication settings.

• Confirm that the required networks are advertised.

• Check interface costs and the routing table.

• Confirm that area 0 connectivity is correct in multiarea configurations.

OSPFv2 and OSPFv3

• OSPFv2 — Used for IPv4 routing.
• OSPFv3 — Originally designed for IPv6 routing and also supports address-family extensions for IPv4 on supported platforms.

IPv6 OSPFv3 configuration differs from OSPFv2. Interface-level commands and address-family configuration depend on the Cisco IOS version and platform.

Route Summarization

Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.

Example networks:

192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Can be summarized as:

192.168.0.0/22

Configure Manual Summarization (EIGRP)

Applied on the outgoing interface.

interface GigabitEthernet0/0
 ip summary-address eigrp 100 192.168.0.0 255.255.252.0

Configure Manual Summarization (OSPF ABR)

Configured under the OSPF process (on an ABR).

router ospf 1
 area 0 range 192.168.0.0 255.255.252.0

Show Routing Information

View Routing Table

show ip route

View Specific Route

show ip route 192.168.1.0

View Routing Protocol Information

show ip protocols

Cisco IOS Command Reference

A quick-reference guide for common Cisco IOS commands on switches and routers.

---

Device & System Information

Show MAC Address Table

show mac address-table

Show OS and Device Version

show version

Show Logged-in Users

show users

Show Files

dir
dir nvram:

---

Configuration Files

Erase Configurations

erase startup-config
delete flash:vlan.dat

Show Configurations

show running-config
show startup-config

Show Interface Config

show run interface g0/0

Filter Running Config (grep-like)

show run | include {searchterm}
show run | exclude {searchterm}
show run | begin {searchterm}
show run | section {section-name}

Save Running Config

copy running-config startup-config
copy run start
wr

---

User Privileges & Security

Enter Privileged Mode ("elevate to root")

enable

Set Encrypted Enable Password

enable secret ThisisaSecret

Encrypt Plaintext Passwords (Weak Encryption)

You can decrypt these with publicly available tools like https://keydecryptor.com/decryption-tools/cisco7

service password-encryption

---

Interface & Network Status

Interface IP Summary

show ip interface brief
show ipv6 interface brief

Interface IP Summary (filtered to only interfaces with IPs)

show ip interface brief | exclude unassigned

VLAN & Switching

Show VLANs

show vlan brief

Show Interface VLAN Details

show interface g0/1 switchport

Show Trunk Interfaces

show int trunk

Clear Tables

clear mac address-table
clear arp-cache

---

Telnet & Remote Access

Connect via Telnet

connect {DeviceName}

Show Hosts & Sessions

show hosts
show sessions

Disconnect Session

disconnect {DeviceName}

Suspend Active Session

Ctrl+Shift+6, then x

---

SSH Configuration

Basic SSH Setup

ip domain-name cisco.com
crypto key generate rsa
ip ssh version 2

Generate RSA Keys (1-liner)

crypto key generate rsa general-keys modulus 1024

Remove RSA Keys

crypto key zeroize rsa

Create Local User

username admin secret ccna

Set Default Gateway (switch)

ip default-gateway 192.168.10.1

Enable SSH on VTY Lines

line vty 0 15
 transport input ssh
 login local
 exit

---

Global Configuration Mode

Enter Global Config

configure terminal

Disable DNS Lookup on Typos

no ip domain-lookup

Set MOTD Banner

banner motd MESSAGEHERE

Set Hostname

hostname HOSTNAME

---

Line Configuration

Console Line

line con 0
 password itsasecret
 login

VTY Lines

line vty 0 15
 password itsasecret
 login

---

Interface Configuration

Interface Selection

interface vlan 1
interface fa0/1
interface range fa0/2-3
interface range fa0/2-3,g0/1

Enable Interface

no shutdown

Assign IPv4 Address

ip address 192.168.0.1 255.255.255.0

Assign IPv4 Default Gateway (Switch)

ip default-gateway 192.168.0.254

Interface IPv6 Configuration

Assign IPv6 Address

ipv6 address 2001:DB8:CAFE:1::1/64

Assign Link-Local Address

ipv6 address fe80::1 link-local

Remove IPv6 Addresses

no ipv6 address 2001:DB8:CAFE:1::1/64
no ipv6 address

IPv6 ND Other-Config Flag

Set the "Other Configuration" flag in IPv6 Neighbor Discovery (ND) messages. - When enabled, it signals to IPv6 hosts that they should obtain additional configuration information (such as DNS server addresses) via DHCPv6, even if they have a stateless autoconfigured address.

ipv6 nd other-config-flag

---

VLAN Configuration

Create / Configure VLAN

vlan 10
 name MyAwesomeVlan

---

Access / Trunk Switchport Configuration

Access Port

Configures the interface as an access port and assigns it to VLAN 10.

switchport mode access
switchport access vlan 10

Trunk Port

Configures the interface as a trunk port using 802.1Q encapsulation.

switchport trunk encapsulation dot1q
switchport mode trunk

Trunk Allowed VLANs

Specifies which VLANs are allowed to traverse the trunk link.

switchport trunk allowed vlan 10,20,33,99

Trunk Native VLANs

Sets the native VLAN for untagged traffic on the trunk.

switchport trunk native vlan 99

Trunk Nonegotiate

Disables DTP (Dynamic Trunking Protocol) negotiation on the trunk interface.

switchport nonegotiate

EtherChannel Configuration

Create EtherChannel (LACP Active)

Configures interfaces to actively negotiate EtherChannel using LACP.

interface range g0/1 - 2
 channel-group 1 mode active

Create EtherChannel (LACP Passive)

Configures interfaces to respond to LACP negotiation.

interface range g0/1 - 2
 channel-group 1 mode passive

Create EtherChannel (On Mode)

Forces EtherChannel without negotiation protocol.

interface range g0/1 - 2
 channel-group 1 mode on

Configure Port-Channel as Access Port

Applies access configuration to the logical Port-Channel interface.

interface port-channel 1
 switchport mode access
 switchport access vlan 10

Configure Port-Channel as Trunk

Applies trunk configuration to the logical Port-Channel interface.

interface port-channel 1
 switchport trunk encapsulation dot1q
 switchport mode trunk

Verify EtherChannel

Displays EtherChannel status and summary information.

show etherchannel summary

Verify Port-Channel Interface

Displays detailed information about the Port-Channel interface.

show interfaces port-channel 1

DHCP

Configure a DHCP Server on a Cisco Router

Assigns IP addresses automatically to clients on a network.

ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Exclude addresses that should not be assigned dynamically

ip dhcp pool LAN_POOL
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 8.8.8.8 8.8.4.4
 lease 7

• excluded-address: Prevents certain IPs from being assigned (like static IPs for servers or routers).
• network: Defines the subnet for DHCP clients.
• default-router: Sets the gateway IP for clients.
• dns-server: Specifies DNS servers for clients.
• lease: Duration the IP is valid (in days).

Configure DHCP Relay (IP Helper)

Forwards DHCP requests from clients to a remote DHCP server.

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip helper-address 192.168.2.100

• ip helper-address: IP of the DHCP server to forward requests to.
• Needed when the server is on a different subnet.

Verify DHCP Status

show ip dhcp binding      ! Shows assigned IP addresses
show ip dhcp pool         ! Shows pool usage and statistics
show running-config       ! Check DHCP configuration

Best Practices

• Exclude static IP addresses from DHCP pools.
• Use DHCP relay when clients and server are on different subnets.
• Monitor DHCP bindings to prevent IP conflicts.

Spanning Tree

Enable PortFast on an interface

Use PortFast on edge/access ports that connect to end devices.

interface GigabitEthernet0/1
 spanning-tree portfast

Enable PortFast globally

Enables PortFast on all access ports.

spanning-tree portfast default

Enable PortFast on a trunk (use with caution)

Only use when the trunk connects to a single end device (not another switch).

interface GigabitEthernet0/1
 spanning-tree portfast trunk

Verify PortFast status

show spanning-tree interface GigabitEthernet0/1 detail

Disable PortFast on an interface

interface GigabitEthernet0/1
 no spanning-tree portfast

Best Practice: Enable BPDU Guard with PortFast

Shuts down the port if a BPDU is received, protecting against loops.

Per interface:

interface GigabitEthernet0/1
 spanning-tree portfast
 spanning-tree bpduguard enable

Globally:

spanning-tree portfast default
spanning-tree bpduguard default

Set the Root Bridge

The root bridge is the central switch in the spanning tree topology. It is chosen based on the lowest bridge priority. A lower priority value increases the likelihood of a switch becoming the root bridge.

Set priority to influence root bridge selection:

• The default priority value is **32768** for all switches.
• Priority is set in increments of **4096**, and this value is added to the VLAN ID (e.g., for VLAN 1, the default bridge priority would be 32768).

To influence the root bridge selection, change the priority value:

interface GigabitEthernet0/1
 spanning-tree vlan 1 priority 4096
 (Sets a lower priority value, increasing the likelihood of this switch becoming the root bridge for VLAN 1)

Set the root bridge for a specific VLAN:

• To make the current switch the root bridge:

spanning-tree vlan 1 root primary
 (This automatically sets the priority lower than the default value, typically to 24576, to ensure this switch becomes the root bridge)

• To make the current switch the backup root bridge:

spanning-tree vlan 1 root secondary
 (This sets the priority higher than the primary root, typically to 28672, making it the backup root bridge)

Alternatively, manually set the root bridge priority:

interface GigabitEthernet0/1
 spanning-tree vlan 1 priority 24576
 (Sets this switch with a higher priority, making it more likely to become the root bridge)

Verify Root Bridge

show spanning-tree vlan 1
(Shows the current root bridge and its priority, along with other STP details)

Notes

• Do not enable PortFast on ports connected to other switches (this can cause network loops).
• PortFast should only be used on access/edge ports that connect to end devices like PCs, printers, or phones.
• Incorrect use of PortFast can cause Layer 2 loops.
• The default priority value is **32768**, and it is adjusted in increments of **4096**.
• Lower priority values increase the likelihood of becoming the root bridge.
• The priority value combined with the MAC address (if priorities are equal) is used to determine the root bridge.

DHCP Snooping

Enable DHCP Snooping globally

Enable DHCP Snooping for the switch.

ip dhcp snooping

Enable DHCP Snooping on a VLAN

DHCP Snooping only operates on specified VLANs.

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

Configure trusted interfaces

Mark uplinks or ports connected to legitimate DHCP servers as trusted.

interface GigabitEthernet0/1
 ip dhcp snooping trust

Untrusted interfaces (default)

Access ports are untrusted by default. DHCP server responses are blocked.

interface GigabitEthernet0/2
 no ip dhcp snooping trust

Configure DHCP Snooping rate limiting

Protect against DHCP starvation attacks. Limits to 15 DHCP packets per second, will mark port as violating otherwise.

interface GigabitEthernet0/2
 ip dhcp snooping limit rate 15

Verify DHCP Snooping status

show ip dhcp snooping
show ip dhcp snooping binding

Disable DHCP Snooping

no ip dhcp snooping
no ip dhcp snooping vlan 10

Notes

• Only trusted ports can send DHCP server messages
• Access ports should remain untrusted
• Commonly used with Dynamic ARP Inspection and IP Source Guard
• Requires correct VLAN configuration to function properly

Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.

Enable DAI globally

Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).

ip arp inspection

Enable DAI on a VLAN

Specify which VLANs should be protected.

ip arp inspection vlan 10
ip arp inspection vlan 20
ip arp inspection vlan 10,20   (alternative: range)

Configure trusted interfaces

Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.

interface GigabitEthernet0/1
 ip arp inspection trust

Trusted ports forward ARP packets without validation.

Untrusted interfaces (default)

Access ports are untrusted by default. Invalid ARP packets are dropped.

interface GigabitEthernet0/2
 no ip arp inspection trust   (optional; this is the default)

Configure ARP rate limiting

Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).

interface GigabitEthernet0/2
 ip arp inspection limit rate 15   (example: 15 packets per second)
 ip arp inspection limit rate 100 burst interval 1   (optional: higher rate with burst)

Additional Validation Checks

By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).

ip arp inspection validate src-mac
ip arp inspection validate src-mac dst-mac ip   (common: enable all three)

Options:

• src-mac — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).
• dst-mac — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).
• ip — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.

Each new ip arp inspection validate command overrides previous ones, so specify all desired options together.

To disable: no ip arp inspection validate [src-mac] [dst-mac] [ip]

Verify DAI status

show ip arp inspection
show ip arp inspection vlan 10
show ip arp inspection interfaces
show ip arp inspection statistics   (shows drops, rate limit violations)
show ip arp inspection log   (logs of dropped packets)

Disable DAI

no ip arp inspection
no ip arp inspection vlan 10

Notes

• Requires DHCP Snooping to build the ARP binding table (enable with ip dhcp snooping + ip dhcp snooping vlan ...).
• Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).
• Access ports should remain untrusted to enforce checks.
• Commonly deployed with PortFast + BPDU Guard on access ports for loop/spanning-tree protection.
• For non-DHCP environments, use static ARP ACLs: ip arp inspection filter arp-acl-name vlan 10.
• Often combined with IP Source Guard (ip verify source) on access ports to filter IP traffic based on the same bindings.
• Rate limiting helps prevent DoS; monitor with show ip arp inspection statistics and consider errdisable recovery cause arp-inspection for automatic port recovery.
• Additional validation (src-mac, dst-mac, ip) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least src-mac and ip in most production setups.
• DAI is ingress-only (checks incoming packets on untrusted ports).

Port Security

View status of port security on an interface

show port-security interface f0/1

Activate Port Security on an interface

The port cannot be a dynamic port:

switchport mode access

Enable Port Security

switchport port-security

Set the maximum number of mac addresses that can be used on that port

switchport port-security maximum 1

Whitelist a specific mac address

switchport port-security mac-address 0001.6311.E7BC

Enable sticky mode to automatically learn mac addresses

switchport port-security mac-address sticky

Port Security Violation Modes

Protect

Silently drops packets from unknown MAC addresses while keeping the port up and generating no alerts.

switchport port-security violation protect

Restrict

Drops packets from unknown MAC addresses and logs the violation while incrementing the security counter.

switchport port-security violation restrict

Shutdown

Immediately disables the port when an unknown MAC address is detected, placing it into an error-disabled state.

switchport port-security violation shutdown

Port Security Aging

Enable static aging on an interface

switchport port-security aging static

Enable timed aging on an interface (5 minutes)

switchport port-security aging time 5

Routing

Routing is the process of forwarding packets between different networks using routing tables and routing protocols.

Enable IP Routing (Layer 3 Switch)

Required on multilayer switches to allow routing between VLANs.

ip routing

Enable IPv6 Routing (Routers)

ipv6 unicast-routing

Static Routing

Configure a Static Route

Manually define a path to a remote network. Here's an example using the default administrative distance value.

ip route 192.168.2.0 255.255.255.0 192.168.1.1

Manually define a path to a remote network and specify the administrative distance.

ip route 192.168.2.0 255.255.255.0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <next-hop-ip> <administrative-distance (optional)>

Configure a Fully Specified Static Route

A fully specified static route includes both the next-hop IP address and the exit interface. This is commonly used on multi-access networks.

Example:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1

You can also specify the administrative distance:

ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0 192.168.1.1 10

Format:

ip route <destination-network> <subnet-mask> <exit-interface> <next-hop-ip> <administrative-distance (optional)>

Configure a Default Route / Default Gateway

Route used when no specific route matches the destination.

ip route 0.0.0.0 0.0.0.0 192.168.1.1

ipv6 route ::/0 2001:ABC:33:44::1

Administrative Distance

Determines which route is preferred when multiple routes to the same destination exist.

Common values:

Connected – 0
Static – 1
EIGRP – 90
OSPF – 110
RIP – 120

Chart pulled from https://en.wikipedia.org/wiki/Administrative_distance#Default_administrative_distances

Routing protocol	Administrative distance
Directly connected interface	0 (Only the interface itself has an administrative distance of 0, since a route cannot have a distance of less than 1.)
Static route	1
Dynamic Mobile Network Routing (DMNR)	3
EIGRP summary route	5
External BGP	20
EIGRP internal route	90
IGRP	100
Open Shortest Path First (OSPF)	110
Intermediate System to Intermediate System (IS-IS)	115
Routing Information Protocol (RIP)	120
Exterior Gateway Protocol (EGP)	140
On Demand Routing (ODR)	160
EIGRP external route	170
Internal BGP	200
Next Hop Resolution Protocol (NHRP)	250
Default static route learned via DHCP	254
Unknown and unused	255 (An administrative distance of 255 causes the router to remove the route from the routing table and not use it.)

Dynamic Routing

Dynamic routing protocols automatically exchange routing information between routers.

Configure RIP v2

Uses hop count as metric (maximum 15 hops).

router rip
 version 2
 no auto-summary
 network 192.168.1.0

Configure EIGRP

Uses bandwidth and delay as composite metric.

router eigrp 100
 no auto-summary
 network 192.168.1.0 0.0.0.255

Configure OSPF

Open Shortest Path First (OSPF) is a link-state routing protocol that uses cost as its metric. OSPF routers exchange link-state advertisements (LSAs) to build a link-state database (LSDB) and use the Dijkstra shortest-path-first (SPF) algorithm to calculate the best routes.

Basic OSPF Configuration

OSPFv2 is used for IPv4 routing. The process ID is locally significant, meaning it does not have to match between routers.

router ospf 1 
network 192.168.1.0 0.0.0.255 area 0

router ospf 1 — Starts OSPF process 1.

network — Identifies interfaces that participate in OSPF based on their IP addresses.

0.0.0.255 — Wildcard mask matching the 192.168.1.0/24 network.

area 0 — Places matching interfaces in OSPF backbone area 0.

OSPF Router ID

The router ID (RID) is a 32-bit value written in IPv4 address format. It uniquely identifies an OSPF router within the OSPF routing domain.

Router ID Selection

If a router ID is not manually configured, Cisco IOS selects one using the following rules when OSPF starts:

• Use the highest IPv4 address configured on any active loopback interface.
• If no active loopback interface has an IPv4 address, use the highest IPv4 address on an active physical interface.

A manually configured router ID takes precedence over automatic selection.

Configure a Router ID

router ospf 1 
router-id 1.1.1.1

The router ID does not need to be an address assigned to a physical interface. Each router in the same OSPF routing domain should have a unique router ID. Changing the router ID after OSPF has started may require restarting the OSPF process for the change to take effect.

Configure a Loopback Interface

A loopback interface is a logical interface that remains up as long as it is administratively enabled and the router is operational.

interface loopback 0 
ip address 10.10.10.10 255.255.255.255

A loopback interface can provide a stable address for automatic router ID selection. A manually configured router ID is another common option.

OSPF Network Statements and Wildcard Masks

OSPF network statements use wildcard masks to determine which interface IP addresses match the statement. Matching interfaces are enabled for OSPF in the specified area.

Examples:

network 192.168.1.0 0.0.0.255 area 0 
network 10.0.0.0 0.255.255.255 area 0 
network 172.16.1.1 0.0.0.0 area 0

0.0.0.255 — Matches the first 24 bits of the address. 0.255.255.255 — Matches addresses with the first octet set to 10. 0.0.0.0 — Matches one exact interface IP address.

A wildcard mask is the inverse of a subnet mask. Subtract each subnet mask octet from 255 to obtain the corresponding wildcard mask.

OSPF Passive Interfaces

A passive interface advertises its network through OSPF but does not send OSPF hello packets or form OSPF neighbor adjacencies on that interface. This is useful for LANs that contain end devices rather than other routers.

router ospf 1 
passive-interface gigabitEthernet 0/0

To make all interfaces passive by default and selectively enable OSPF neighbor formation on router links:

router ospf 1 
passive-interface default 
no passive-interface gigabitEthernet 0/1

OSPF Cost and Reference Bandwidth

OSPF uses cost to determine the best path. Lower total cost is preferred.

Cost = Reference Bandwidth / Interface Bandwidth

The default reference bandwidth on many Cisco IOS platforms is 100 Mbps. With this default, faster interfaces may receive the same cost, so the reference bandwidth should be adjusted consistently across routers when appropriate.

router ospf 1 
auto-cost reference-bandwidth 1000

This example sets the reference bandwidth to 1000 Mbps (1 Gbps). The value is expressed in Mbps.

An interface cost can also be configured manually:

interface gigabitEthernet 0/1 
ip ospf cost 10

The manually configured cost overrides the calculated cost for that interface.

OSPF Areas

OSPF divides a routing domain into areas to improve scalability and reduce the amount of routing information that must be processed by each router.

• Area 0 — The backbone area.
• Internal router — Has all OSPF interfaces within the same area.
• Backbone router — Has at least one interface in area 0.
• Area Border Router (ABR) — Connects multiple OSPF areas.
• Autonomous System Boundary Router (ASBR) — Redistributes routes from another routing source into OSPF.

In a multiarea OSPF design, non-backbone areas must connect to area 0 logically, directly or through a supported virtual link.

OSPF Neighbor Adjacencies

OSPF routers use hello packets to discover neighbors and maintain adjacencies. Routers on a shared link generally need compatible OSPF settings to become neighbors.

Important parameters include:

• Area ID
• Hello and dead intervals
• Authentication settings, if configured
• Subnet and network compatibility
• OSPF area type
• Unique router IDs

On broadcast networks, routers elect a Designated Router (DR) and Backup Designated Router (BDR) to reduce adjacency overhead. A point-to-point link does not elect a DR or BDR.

OSPF Network Types

Common OSPF network types include:

• Broadcast — Common on Ethernet LANs; supports DR/BDR elections.

• Point-to-point — Common on direct router-to-router links; no DR/BDR election.

• Nonbroadcast multiaccess (NBMA) — Supports multiple routers without the usual broadcast behavior.

The network type affects neighbor discovery and adjacency behavior.

OSPF Default Route Advertisement

A router with a valid default route can advertise it into OSPF so other routers can use it to reach destinations that are not otherwise in their routing tables.

router ospf 1 
default-information originate

By default, this advertises a default route when one exists in the local routing table. The always keyword can be used to advertise the default route even when one is not present, but this should be used carefully.

Verify OSPF

Use these commands to troubleshoot OSPF and confirm that routes and adjacencies are working.

show ip protocols 
show ip ospf 
show ip ospf neighbor 
show ip ospf interface brief 
show ip ospf interface 
show ip ospf database 
show ip route ospf 
show ip route

show ip protocols — Displays routing protocol settings, including OSPF configuration.

show ip ospf — Displays OSPF process information, including the router ID.

show ip ospf neighbor — Shows discovered neighbors and adjacency states.

show ip ospf interface brief — Summarizes OSPF-enabled interfaces and areas.

show ip ospf interface — Displays interface-level OSPF details, including cost and timers.

show ip ospf database — Displays the link-state database.

show ip route ospf — Displays routes learned through OSPF.

show ip route — Displays the complete routing table.

Common OSPF Troubleshooting

If OSPF neighbors or routes are missing, check the following:

• Verify that the correct interfaces have IP addresses and are up.

• Verify that OSPF is enabled on the intended interfaces.

• Check the area ID and hello/dead timers.

• Verify that router IDs are unique.

• Check passive*interface configuration.

• Verify that the interfaces use compatible OSPF network types and authentication settings.

• Confirm that the required networks are advertised.

• Check interface costs and the routing table.

• Confirm that area 0 connectivity is correct in multiarea configurations.

OSPFv2 and OSPFv3

• OSPFv2 — Used for IPv4 routing.
• OSPFv3 — Originally designed for IPv6 routing and also supports address-family extensions for IPv4 on supported platforms.

IPv6 OSPFv3 configuration differs from OSPFv2. Interface-level commands and address-family configuration depend on the Cisco IOS version and platform.

Route Summarization

Route summarization (aggregation) reduces routing table size by advertising one route that represents multiple networks.

Example networks:

192.168.0.0/24
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

Can be summarized as:

192.168.0.0/22

Configure Manual Summarization (EIGRP)

Applied on the outgoing interface.

interface GigabitEthernet0/0
 ip summary-address eigrp 100 192.168.0.0 255.255.252.0

Configure Manual Summarization (OSPF ABR)

Configured under the OSPF process (on an ABR).

router ospf 1
 area 0 range 192.168.0.0 255.255.252.0

Show Routing Information

View Routing Table

show ip route

View Specific Route

show ip route 192.168.1.0

View Routing Protocol Information

show ip protocols