Configure a Cisco IOS XE Router from the CLI

This guide covers a practical initial configuration for a Cisco router running IOS or IOS XE. It configures a hostname, local administrator, SSH access, console security, Ethernet and serial interfaces, a loopback interface, configuration persistence, and an optional RIPv2 lab.

Official references:

Commands and available features vary by platform, license, and software release. Check the device documentation and test remote access before closing the console session.

Understand the Configuration Files

IOS XE applies most commands to the running configuration immediately. The startup configuration is the saved copy loaded at boot. Unsaved running changes are lost after a reload.

Display both configurations:

show running-config
show startup-config

Save the active configuration with the precise filesystem form:

copy system:running-config nvram:startup-config

This commonly used alias performs the same operation on most routers:

copy running-config startup-config

The names contain hyphens. copy running_config startup-config is not valid IOS XE syntax.

Inspect the Router Before Changing It

Record the model, software version, interfaces, routes, and current management configuration:

show version
show inventory
show ip interface brief
show interfaces description
show ip route
show ip protocols
show running-config | section line
show running-config | include ^username
show running-config | include hostname|enable secret|ip domain

On a production router, save an external backup and confirm console or out-of-band access before changing authentication, addressing, or routing.

Enter Configuration Mode

Enter privileged EXEC mode, then global configuration mode:

enable
configure terminal

Use end to return directly to privileged EXEC mode. Use exit to move back one configuration level.

Configure the Device Identity

Set a descriptive hostname and a domain name. SSH key generation requires both on common IOS and IOS XE platforms:

hostname R1
ip domain name example.net

Replace example.net with an internal domain assigned to the organization.

Configure a legal notice with a delimiter that does not appear in the message:

banner motd ^CUnauthorized access to this device is prohibited.^C

The delimiter characters are not displayed to users.

Configure Local Credentials

Replace both example secret strings before entering these commands. Use different, randomly generated values and store them in an approved password manager:

security passwords min-length 12
username netadmin privilege 15 secret REPLACE_WITH_A_UNIQUE_ADMIN_SECRET
enable secret REPLACE_WITH_A_DIFFERENT_ENABLE_SECRET

The secret keyword stores a one-way password verifier supported by the platform. Avoid the older password form for administrator credentials.

Optionally obscure any remaining clear-text line or protocol passwords in the configuration:

service password-encryption

This command commonly produces reversible type 7 values. It prevents casual viewing but does not provide strong password storage and does not encrypt credentials in transit. Use secret credentials and SSH for management access.

Slow repeated login attempts:

login block-for 180 attempts 3 within 60
login delay 2

Confirm that the emergency access procedure is documented before enabling login blocking on a remotely managed production device.

Configure Secure Console Access

Use the local administrator database for console login and disconnect idle sessions after ten minutes:

line console 0
login local
exec-timeout 10 0
logging synchronous
exit

Keep the console session open until a second login has been tested. A credential or authorization mistake can otherwise lock administrators out.

Configure SSH Management

Enable SSHv2 and generate an RSA host key. Cisco recommends the largest modulus supported by the platform and the organization’s security policy; the example uses 4096 bits:

ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
crypto key generate rsa general-keys modulus 4096

Older or resource-constrained lab devices may support a smaller maximum. Use at least 2048 bits when the platform permits it.

Configure all available VTY lines to authenticate against the local user database and accept SSH only:

line vty 0 15
login local
transport input ssh
exec-timeout 10 0
exit

Some platforms expose only VTY lines 0 4. Check the existing line ranges and configure every VTY line supported by the device:

show running-config | section line vty

Verify the SSH server configuration:

end
show ip ssh
show crypto key mypubkey rsa
show users

From a management workstation with IP connectivity, test SSH in a second terminal before ending the console session:

ssh netadmin@192.168.1.1

For a production deployment, restrict VTY access to trusted management networks with an access class or a control-plane policy after confirming the correct source addresses. Use centralized AAA where the organization provides TACACS+ or RADIUS.

Configure the LAN Interface

Discover the actual interface names first:

show ip interface brief

The following example assigns 192.168.1.1/24 to GigabitEthernet0/0/0:

configure terminal
interface GigabitEthernet0/0/0
description Link to LAN1
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
end

Verify the interface and connected route:

show ip interface brief
show interfaces GigabitEthernet0/0/0
show ip route connected

The interface should report up/up. An administratively down interface needs no shutdown; an interface that is up with line protocol down usually has a Layer 1 or Layer 2 problem.

Configure a Loopback Interface

A /32 loopback provides a stable management, monitoring, or routing-protocol identifier when the design routes it correctly:

configure terminal
interface Loopback0
description Router identifier
ip address 10.0.0.1 255.255.255.255
exit
end

Verify it:

show ip interface brief | include Loopback0
show ip route 10.0.0.1

A loopback address is not reachable from other networks until a connected, static, or dynamic route advertises it.

Configure a Serial Interface

The following example uses 192.168.2.0/30 for a point-to-point connection:

configure terminal
interface Serial0/0/0
description Link to R2
ip address 192.168.2.1 255.255.255.252
bandwidth 64
no shutdown
exit
end

The bandwidth 64 value is in Kbit/s. It supplies information to routing protocols and management tools; it does not configure the physical bit rate or shape traffic.

Configure the DCE Clock When Required

Check whether the local end supplies the serial clock:

show controllers Serial0/0/0

Configure clock rate only on the DCE end when required by the physical interface or network simulator:

configure terminal
interface Serial0/0/0
clock rate 64000
end

Do not configure a clock rate on the DTE end. Valid rates depend on the platform and serial hardware.

Verify the serial interface:

show ip interface brief
show interfaces Serial0/0/0
show interfaces Serial0/0/0 | include line protocol|Internet address|MTU|BW

Both physical status and line protocol should be up. If line protocol remains down, compare encapsulation, clocking, addressing, cabling, and the remote interface.

Optional: Configure RIPv2 for a Lab

RIP is a legacy distance-vector protocol with slow convergence and a 15-hop limit. Use OSPF, IS-IS, EIGRP, or another protocol chosen by the network design for new production deployments. This section preserves the original RIPv2 example for a small lab.

On R1, advertise the LAN and serial major networks. Keep the user-facing LAN passive while allowing updates on the link to R2:

configure terminal
router rip
version 2
no auto-summary
passive-interface default
no passive-interface Serial0/0/0
network 192.168.1.0
network 192.168.2.0
exit
end

The command is router rip, not route rip. RIP network statements use classful major-network syntax to select participating interfaces. no auto-summary prevents automatic summarization when routes cross classful boundaries.

For a matching R2 lab, use 192.168.2.2/30 on its serial interface and 172.16.2.1/24 on its LAN interface, then configure:

configure terminal
router rip
version 2
no auto-summary
passive-interface default
no passive-interface Serial0/0/0
network 192.168.2.0
network 172.16.0.0
exit
end

Verify the protocol, RIP database, and learned routes:

show ip protocols
show ip rip database
show ip route rip
show ip route 172.16.2.0

Test the transit link and remote LAN interface from R1:

ping 192.168.2.2 source 192.168.2.1
ping 172.16.2.1 source 192.168.1.1

If no RIP route appears, confirm that the interfaces are up/up, the directly connected addresses and masks match, RIPv2 is enabled on both routers, the serial interface is not passive, and UDP port 520 is not filtered.

Filter Configuration Output

IOS and IOS XE output modifiers make large configurations easier to inspect.

Show every line matching a regular expression:

show running-config | include hostname|username|enable secret

Hide matching lines:

show running-config | exclude ^!

Start at the first matching line and display the rest:

show running-config | begin line console 0

Display a configuration section:

show running-config | section router rip
show running-config | section interface Serial0/0/0

The valid keywords are include, exclude, begin, and section.

Use Command History

Increase the history size for the current terminal session and display its contents:

terminal history size 300
show history

Use the Up and Down arrow keys to recall commands. Avoid copying secrets into shared terminal transcripts or support logs.

Verify and Save the Configuration

Review the important sections and operational state:

show running-config | include hostname|username|enable secret|ip domain
show running-config | section line console
show running-config | section line vty
show running-config | section interface
show ip interface brief
show ip route
show ip protocols
show ip ssh

Test console or SSH access, interface reachability, and routing before saving. Then write the running configuration to the startup configuration:

copy system:running-config nvram:startup-config

Press Enter to accept the default destination filename when prompted, then confirm the saved file:

show startup-config

Create an external backup using an approved secure transfer method. When SCP is configured and supported, IOS XE can copy the configuration to an SCP server:

copy system:running-config scp:

Follow the prompts for the server, username, and destination filename. Protect backups because they can contain usernames, hashes, addresses, keys, and topology details.

Erase the Configuration and Reload

Erasing the startup configuration is destructive and cannot be undone unless a backup exists. It does not remove the active running configuration until the router reloads.

Confirm the correct device, save an external backup, and make sure console access is available. Then erase the startup configuration:

erase nvram:startup-config

Some platforms also accept:

erase startup-config

Verify that the startup configuration is absent, then reload only when the reset is intentional:

show startup-config
reload

When asked whether to save the modified configuration during this reset procedure, saving it would recreate a startup configuration. Read every prompt before responding. A router that boots without a startup configuration normally enters the initial setup dialog.

Troubleshooting

SSH Does Not Start

Verify the hostname, domain name, RSA keys, SSH version, local username, and VTY lines:

show running-config | include hostname|ip domain|username
show crypto key mypubkey rsa
show ip ssh
show running-config | section line vty

Generate a supported RSA key after configuring the hostname and domain name. Ensure that login local and transport input ssh apply to every VTY line.

The LAN Cannot Reach the Router

Check status, addressing, ARP, and the connected route:

show ip interface brief
show interfaces GigabitEthernet0/0/0
show arp
show ip route connected

Confirm the client uses an address from 192.168.1.0/24 and the correct mask. Use 192.168.1.1 as the default gateway only when that matches the network design.

The Serial Link Is Down

Inspect both ends of the link:

show controllers Serial0/0/0
show interfaces Serial0/0/0
show running-config | section interface Serial0/0/0

Confirm no shutdown, compatible encapsulation, the same subnet and mask, a clock on the DCE end when required, and working cabling or simulator links.

Changes Disappear After Reload

Compare the running and startup configurations. If the intended running configuration is correct, save it:

show running-config
show startup-config
copy system:running-config nvram:startup-config