Cisco Router Configuration Basics: First Setup to Verification
A clean router baseline makes every lab and production change easier. This guide covers identity, secure access, interface addressing, routing, SSH, saving, and verification.
Cisco Router Configuration Basics: First Setup to: Table of Contents
1. IOS CLI Modes
Cisco IOS separates commands into modes so viewing status and changing configuration require different privilege levels. User EXEC mode, shown as Router>, offers basic monitoring. The enable command enters privileged EXEC mode, shown as Router#, where you can inspect the running configuration and save or debug the device.
Use configure terminal to enter global configuration mode. Commands such as hostname, usernames, routing processes, and general services begin here. Selecting an interface enters interface configuration mode. Type end to return directly to privileged EXEC, or exit to move back one level.
Use contextual help before guessing: ? lists valid commands and show history displays recent input. In a production environment, confirm the device and current mode at every prompt before pasting configuration.
2. Hostname and Passwords
Start by giving the router a unique hostname and creating an individual local administrator account. Use enable secret, not the older reversible enable password. The sample strings below are placeholders; generate unique secrets and keep them out of public configuration files.
- hostname R1
- enable secret StrongSecret
- username admin privilege 15 secret StrongAdminSecret
- service password-encryption
service password-encryption only obscures some clear-text values in the displayed configuration; it is not a substitute for strong hashing, AAA, or protected configuration backups. Add a legal login banner if required by your organization, configure NTP and logging, and restrict management access with an ACL or dedicated management network.
3. Interface Configuration
Add a useful description, assign the approved address and mask, and bring the interface up. Descriptions should identify the remote device, circuit, VLAN, or business purpose so an engineer can understand the link during an incident.
- interface GigabitEthernet0/0
- description LAN gateway
- ip address 192.168.10.1 255.255.255.0
- no shutdown
Verify with show ip interface brief and show interfaces GigabitEthernet0/0. “Administratively down” means the interface still has shutdown; “down/down” usually indicates a physical or lower-layer problem; “up/down” points toward a data-link or keepalive issue. Check speed, duplex, errors, and the connected device before changing routing.
4. Basic Routing
Small labs often use a default static route before adding a dynamic routing protocol. A default route sends traffic for unknown destinations to an upstream next hop. Confirm that the next hop is reachable and that the upstream router has a return route to the local subnet.
- ip route 0.0.0.0 0.0.0.0 203.0.113.1
- show ip route
For an internal destination, configure a specific static route with the destination network, mask, and next hop. Use show ip route <prefix>, a sourced ping, and traceroute to validate both control-plane selection and forwarding. If the design grows, compare OSPF, EIGRP, and BGP rather than adding unmanaged static routes indefinitely.
5. SSH, Save, and Verify
Use SSH instead of Telnet because SSH encrypts credentials and management traffic. Configure a domain name, generate an RSA key, force SSH on the VTY lines, and use local login or centralized AAA. Restrict which source networks may reach the management plane.
- ip domain-name netest.local
- crypto key generate rsa modulus 2048
- transport input ssh
- copy running-config startup-config
Test a second management session before closing the console or existing session. Review show ip ssh, show users, and the VTY configuration. After interface and routing tests pass, save with copy running-config startup-config and confirm the destination filename when prompted.
6. Baseline verification and rollback
Capture show running-config, show ip interface brief, show ip route, show cdp neighbors detail or show lldp neighbors detail, and relevant logs. The output creates a known-good baseline and makes later troubleshooting less dependent on memory.
Before a remote change, verify console or out-of-band access and prepare the exact commands needed to reverse it. Some platforms support configuration replace, archive, or timed rollback features. In a lab, deliberately remove a route or shut an interface, observe the symptoms, then restore it and confirm that routes and forwarding return.
7. Common first-configuration mistakes
- Wrong address or mask: compare the interface plan and check for overlapping subnets.
- Interface left shut: use
no shutdownand verify physical link state. - No return route: a successful outbound route alone does not create bidirectional reachability.
- VTY permits Telnet or no login method: explicitly allow SSH and configure authenticated access.
- Unsaved changes: compare running and startup configurations after validation.
- Copied production secrets: sanitize examples and rotate any credential exposed outside the approved store.
Cisco Router Configuration Basics: First Setup to: Frequently Asked Questions
How do I enter config mode?
Use enable, then configure terminal.
How do I save configuration?
Use copy running-config startup-config, then verify the startup configuration or archive according to your platform's operating procedure.
Should I use Telnet or SSH?
Use SSH because it encrypts management traffic.
Why is an interface still down after no shutdown?
Check cabling, optics, the remote interface, speed and duplex, switchport or encapsulation settings, and interface error counters. Administrative state is only one layer.
Why can the router ping out but hosts cannot?
Verify host addressing and gateway, router ACLs or NAT, the return route, and whether the router's ping used a different source address from the hosts.