Cisco Ios Patterns

Cisco IOS Patterns

Reference patterns for working with Cisco IOS and IOS-XE — the most common network OS in enterprise environments. Covers config syntax, show commands, privilege levels, and the gotchas that cause the most operational incidents.

When to Activate

• Writing or reviewing Cisco IOS/IOS-XE configuration
• Generating show commands for troubleshooting
• Explaining IOS config mode hierarchy or privilege levels
• Helping with ACL wildcard mask calculations
• Diagnosing why a config change didn't take effect
• Automating IOS device interaction with Python/Netmiko

Config Mode Hierarchy

Copy code
Router> enable                    # Enter privileged EXEC (requires enable password)
Router# configure terminal        # Enter global config mode
Router(config)# interface Gi0/0   # Enter interface sub-mode
Router(config-if)# ip address 10.0.0.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# exit           # Back to global config
Router(config)# router bgp 65001  # Enter routing process sub-mode
Router(config-router)# end        # Jump straight back to privileged EXEC
Router# write memory              # Save — or use: copy running-config startup-config

Critical gotcha: forgetting write memory IOS running-config is in RAM. A reload without saving loses all unsaved changes. Always verify with show running-config | include <key phrase> before and after a change window, then save.

Essential Show Commands

Copy code
# System state
show version                      # IOS version, uptime, hardware
show inventory                    # Physical hardware/modules
show processes cpu sorted         # CPU utilization
show memory statistics            # Memory usage

# Interfaces
show interfaces                   # Full interface detail — errors, counters, speed/duplex
show ip interface brief           # Quick status table for all interfaces
show interfaces GigabitEthernet0/0 # Single interface detail
show interfaces trunk             # Trunk port status and allowed VLANs

# Routing
show ip route                     # Full routing table
show ip route 10.0.0.0            # Longest match for a specific prefix
show ip protocols                 # Running routing protocols + parameters
show ip ospf neighbor             # OSPF adjacency table
show bgp summary                  # BGP session table

# Layer 2
show vlan brief                   # VLAN table
show spanning-tree                # STP state per VLAN
show mac address-table            # CAM table

# Access lists
show ip access-lists              # ACL contents + hit counters
show ip access-lists MYACL        # Specific ACL

# Logging and events
show logging                      # Syslog buffer
show ip nat translations          # Active NAT entries

Wildcard Masks

Wildcard masks are the inverse of subnet masks. 0 = must match, 1 = don't care.

Copy code
# Subnet mask  →  Wildcard mask
255.255.255.0  →  0.0.0.255      (match /24 network)
255.255.255.252 → 0.0.0.3        (match /30 — point-to-point links)
255.255.0.0    →  0.0.255.255    (match /16 network)
255.0.0.0      →  0.255.255.255  (match /8 network)
0.0.0.0        →  255.255.255.255 (match any host — used in OSPF: network 0.0.0.0 255.255.255.255 area 0)
255.255.255.255 → 0.0.0.0        (match one specific host)

# Formula: wildcard = 255.255.255.255 - subnet_mask
# Example: wildcard for 255.255.255.224 = 255.255.255.255 - 255.255.255.224 = 0.0.0.31

# ACL examples
access-list 10 permit 192.168.1.0 0.0.0.255     # Permit entire /24
access-list 10 permit 10.0.0.1 0.0.0.0          # Permit single host
access-list 10 permit 172.16.0.0 0.0.255.255     # Permit entire /16

# OSPF network statements
router ospf 1
  network 10.0.0.0 0.0.0.255 area 0    # Advertise /24 in area 0
  network 0.0.0.0 255.255.255.255 area 0  # Advertise all interfaces (use with care)

ACL Structure and Implicit Deny

Copy code
# Every ACL ends with an invisible implicit deny all
# If no permit matches, traffic is dropped silently

ip access-list extended INBOUND
  10 permit tcp 10.0.0.0 0.0.0.255 any eq 80
  20 permit tcp 10.0.0.0 0.0.0.255 any eq 443
  30 permit icmp any any
  ! implicit deny ip any any here — no log, no counter increment

# Make the deny visible and logged
ip access-list extended INBOUND
  10 permit tcp 10.0.0.0 0.0.0.255 any eq 80
  20 permit tcp 10.0.0.0 0.0.0.255 any eq 443
  30 permit icmp any any
  999 deny ip any any log   # Now shows in 'show ip access-lists' with hit count

# Check ACL hit counts to confirm traffic is matching expected entries
show ip access-lists INBOUND

Interface Configuration Patterns

Copy code
interface GigabitEthernet0/0
 description UPLINK-TO-CORE
 ip address 10.0.1.1 255.255.255.252
 no shutdown
 duplex full
 speed 1000

# Layer 2 access port
interface GigabitEthernet0/1
 description WORKSTATION-PORT
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 no shutdown

# Layer 2 trunk port
interface GigabitEthernet0/2
 description TRUNK-TO-DISTRIBUTION
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,100
 switchport trunk native vlan 999
 no shutdown

# Loopback — used for management, BGP update-source, router-id
interface Loopback0
 description MGMT-LOOPBACK
 ip address 10.255.0.1 255.255.255.255

Privilege Levels

Copy code
# IOS has 16 privilege levels (0–15)
# 0 = user EXEC (ping, traceroute, show version)
# 1 = default user mode
# 15 = full privileged EXEC (all commands)

# Assign a specific command to a lower privilege level
privilege exec level 5 show running-config

# Create a user at a specific privilege level
username readonly privilege 5 secret MyPassword

# Check current privilege level
show privilege

# Drop back from privileged to user EXEC
disable

Saving and Verifying Config

Copy code
# Save running config to startup config (survives reload)
write memory
# or equivalently:
copy running-config startup-config

# View only the lines you care about
show running-config | include bgp
show running-config | include interface|ip address
show running-config | section router bgp
show running-config | section interface GigabitEthernet

# Compare running vs startup (identify unsaved changes)
show archive config differences nvram:startup-config system:running-config

Anti-Patterns

Copy code
# BAD: Applying an ACL to an interface without testing it first
# An overly broad deny can black-hole your own management traffic
# Always verify the ACL with 'show ip access-lists' and test from a safe source first

# BAD: Using wrong wildcard mask in OSPF network statement
router ospf 1
  network 10.0.0.0 255.255.255.0 area 0   # WRONG — this is a subnet mask, not wildcard
  network 10.0.0.0 0.0.0.255 area 0       # CORRECT

# BAD: Forgetting 'no shutdown' on a new interface
interface GigabitEthernet0/1
  ip address 192.168.1.1 255.255.255.0
  # Missing 'no shutdown' — interface stays down

# BAD: Putting ACL on wrong interface direction
# 'in' filters traffic entering the interface (from that network into the router)
# 'out' filters traffic leaving the interface (from the router to that network)
ip access-group MYACL in   # Applied to the interface, not the ACL definition

Best Practices

• Always add description to every interface and BGP neighbor — makes troubleshooting faster
• Use named ACLs (ip access-list extended NAME) instead of numbered — easier to edit individual entries
• Set service timestamps log datetime msec localtime so log entries have useful timestamps
• Configure logging buffered 16384 informational to keep a local syslog buffer
• Use no ip domain-lookup to prevent IOS from trying to DNS-resolve mistyped commands
• Set exec-timeout 15 0 on VTY lines so idle sessions don't lock out other users
• Test ACLs with show ip access-lists hit counters before and after applying

Related Skills

• network-bgp-diagnostics
• network-interface-health
• network-config-validation