Skip to content

Routing & Switching S2 — Cheatsheet

Cisco IOS, switching, VLANs and routing — 2024–2025

Table of Contents

Cisco IOS Basics

User EXEC          Router>
Privileged EXEC    Router#
Global config      Router(config)#
Interface config   Router(config-if)#
Line config        Router(config-line)#

enable
configure terminal
hostname R1
no ip domain-lookup
enable secret StrongPassword
service password-encryption
banner motd #Authorized access only#

line console 0
 password consolepw
 login
 logging synchronous

line vty 0 4
 login local
 transport input ssh

username admin secret StrongPassword
ip domain-name lab.local
crypto key generate rsa modulus 2048
ip ssh version 2

copy running-config startup-config

show running-config
show startup-config
show ip interface brief
show interfaces
show version
show cdp neighbors detail

Abbreviations

IOS accepts unique abbreviations and ? for context help. In documentation, prefer recognizable full commands.

Switching and MAC Tables

A switch learns source MAC addresses and forwards known unicast directly to the right port. Unknown unicast and broadcast are flooded within the VLAN.

show mac address-table
clear mac address-table dynamic
show interfaces status
show interfaces counters errors

Collision domain: per switch port. Broadcast domain: per VLAN. Full duplex eliminates classic collisions; a duplex/speed mismatch still causes poor performance and errors.

Port security

interface g0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict

Modes: protect drops silently, restrict drops and counts/logs, shutdown puts the port into err-disabled state.

VLANs and Trunks

vlan 10
 name USERS
vlan 20
 name SERVERS

interface range f0/1-12
 switchport mode access
 switchport access vlan 10

interface g0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999

An access port carries traffic for one VLAN untagged. An 802.1Q trunk carries multiple VLANs; native VLAN traffic is untagged by default. The native VLAN and the allowed VLAN list must match on both ends.

show vlan brief
show interfaces trunk
show interfaces switchport

A VLAN doesn't exist everywhere automatically

The trunk may allow VLAN 20, but the VLAN also needs to exist in the local VLAN database.

Inter-VLAN Routing

Router-on-a-stick

interface g0/0
 no shutdown
interface g0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface g0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

Layer-3 switch with SVIs

ip routing
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown

An SVI only comes line-protocol-up once the VLAN exists and at least one associated active L2 port/trunk is present.

Spanning Tree and EtherChannel

Redundant L2 links can cause broadcast storms, duplicate frames and unstable MAC tables. STP picks a loop-free tree:

  1. The lowest bridge ID becomes the root bridge.
  2. Each non-root switch picks a root port.
  3. Each segment gets one designated port.
  4. Redundant paths are logically blocked.
show spanning-tree
spanning-tree vlan 10 root primary

interface range f0/1-10
 spanning-tree portfast
 spanning-tree bpduguard enable

Use PortFast only on edge ports. BPDU Guard disables an edge port if BPDUs still arrive on it.

EtherChannel

Protocol Modes
LACP active/passive
PAgP desirable/auto
static on/on 
interface range g0/1-2
 channel-group 1 mode active
interface port-channel 1
 switchport mode trunk

show etherchannel summary

All member ports must have the same speed, duplex, access/trunk mode, native VLAN and allowed VLANs.

IPv4 and IPv6 Routing

A router picks the route via:

  1. longest prefix match;
  2. lowest administrative distance for an equal prefix;
  3. lowest metric within the same protocol.
show ip route
show ipv6 route
show ip protocols
show interfaces

Route codes: C connected, L local, S static, O OSPF, R RIP.

interface g0/0
 ip address 10.0.0.1 255.255.255.252
 ipv6 address 2001:db8:1::1/64
 no shutdown
ipv6 unicast-routing

Static Routing

ip route 192.168.20.0 255.255.255.0 10.0.0.2
ip route 0.0.0.0 0.0.0.0 10.0.0.2

ipv6 route 2001:db8:20::/64 2001:db8:1::2
ipv6 route ::/0 2001:db8:1::2

A floating static route gets a higher administrative distance and only becomes active once the preferred route disappears.

ip route 192.168.20.0 255.255.255.0 10.0.1.2 200

Both directions

A ping also fails when only the return route is missing. Check the routing tables on both ends.

Dynamic Routing

RIP/RIPng — concept

RIP uses hop count as its metric; maximum 15 hops. It's simple but converges slowly and scales poorly.

OSPF — core

OSPF is a link-state IGP. Routers build a link-state database and compute shortest paths. All interfaces within area 0 form the backbone.

router ospf 1
 router-id 1.1.1.1
 network 10.0.0.0 0.0.0.3 area 0
 network 192.168.10.0 0.0.0.255 area 0
 passive-interface g0/1

show ip ospf neighbor
show ip ospf interface brief
show ip route ospf

Wildcard mask = the inverse of the subnet mask bits; for /24 this is 0.0.0.255, for /30 0.0.0.3.

Adjacency problems: area mismatch, subnet mismatch, hello/dead timers, authentication, MTU or duplicate router ID.

ACL, NAT and DHCP

ACL

  • A standard ACL matches source IPv4; place it close to the destination.
  • An extended ACL matches protocol, source, destination and ports; place it close to the source.
  • First match wins; an implicit deny any sits at the bottom.
ip access-list extended WEB_ONLY
 permit tcp 192.168.10.0 0.0.0.255 host 192.168.20.10 eq 443
 deny ip any any log
interface g0/1
 ip access-group WEB_ONLY in

NAT/PAT

access-list 1 permit 192.168.10.0 0.0.0.255
interface g0/0
 ip nat inside
interface g0/1
 ip nat outside
ip nat inside source list 1 interface g0/1 overload

show ip nat translations
show ip nat statistics

DHCP server on IOS

ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp pool USERS
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 192.168.20.10
 domain-name lab.local

For an external DHCP server on a different subnet:

interface vlan 10
 ip helper-address 192.168.20.10

Troubleshooting

show ip interface brief
show interfaces status
show vlan brief
show interfaces trunk
show spanning-tree
show etherchannel summary
show mac address-table
show arp
show ip route
show access-lists
ping <ip>
traceroute <ip>

Order: physical link → interface/config → VLAN/access port → trunk → STP/EtherChannel → IP/prefix → gateway/routing → ACL/NAT → application.

Compare both ends

Most lab issues are asymmetric: a trunk on only one side, a wrong subnet mask, a shutdown interface, or a missing return route.