Cisco IOS, 1993

What you will do

1. move from user EXEC to privileged EXEC mode enable

   Cisco IOS traces back to 1986. The user/privileged EXEC split exists so a mistyped command in "look but don't touch" mode can never reconfigure the box.

2. enter global configuration mode conf t

   "conf t" is muscle memory for every network engineer alive. Global config mode is where the running-config actually changes.

3. rename the device — the prompt updates live to R1 hostname R1

   The hostname is the first line of running-config, and the first thing you check in a multi-device topology to know which box you are on.

4. set a login banner between two delimiter characters banner motd #Authorized access only#

   A banner motd is not decoration — courts have held that a clear login banner is what makes "unauthorized access" legally provable in the first place.

5. enter interface configuration mode for GigabitEthernet0/0 int gi0/0

   Every physical and virtual interface (routed port, switchport, subinterface, SVI) gets its own config-if context.

6. assign an IP address and subnet mask to the interface ip address 10.0.0.1 255.255.255.0

   ip address always takes an address AND a mask — IOS never infers the mask from address class the way some older tools guessed.

7. administratively bring the interface up no shut

   Cisco interfaces ship administratively shutdown by default. New techs forget "no shutdown" more than any other command: a perfectly cabled, perfectly addressed port that just never comes up.

8. step back one configuration level — from config-if to config exit

   exit walks up exactly one mode at a time. "end" (a few missions from now) is the shortcut that jumps straight to privileged EXEC from anywhere.

9. verify interface status and IP addressing at a glance sh ip int br

   "show ip int br" is the very first command run on any unfamiliar device — one screen shows every interface's address and up/down state.

10. add a static route to a remote network via a next-hop ip route 172.16.0.0 255.255.0.0 10.0.0.2

    A static route is destination network + mask + next-hop. Simple, predictable, and still how most small networks route to their edge today.

11. view the routing table — connected, static and learned routes sh ip route

    C = directly connected, S = static, O = OSPF-learned. Reading this table correctly is one of the most heavily tested router skills there is.

12. create VLAN 10 and enter VLAN configuration mode vlan 10

    A VLAN is a broadcast domain drawn in software, not in cabling. VLAN 1 is the factory default — leaving production traffic on it is a well-known hardening mistake, never a deliberate design choice.

13. give the current VLAN a human-readable name name SALES

    "VLAN 10" tells you nothing six months later. "SALES" tells the next engineer everything at a glance.

14. select an access port to put a device on VLAN 10 int gi0/2

    A switchport belongs to exactly one access VLAN unless it is explicitly trunked — that single rule is the entire access-layer model.

15. set the port to access mode — it carries one VLAN, untagged switchport mode access

    Access ports carry a single VLAN untagged — this is how an end-user PC or phone actually connects to the network.

16. assign the port to VLAN 10 switchport access vlan 10

    Once assigned, every frame in or out this port belongs to VLAN 10 as far as the rest of the switched network is concerned.

17. create a second VLAN — every real network has more than one vlan 20

    Two VLANs on one switch are isolated broadcast domains by default — they cannot reach each other without a router. That is exactly the problem the rest of this track solves.

18. select the uplink port that will carry BOTH VLANs to the router int gi0/1

    One physical link needs to carry multiple VLANs' traffic between switch and router — that is exactly what trunking exists to solve.

19. make the uplink a trunk — it now tags frames with their VLAN ID switchport mode trunk

    802.1Q trunking (1998) inserts a 4-byte VLAN tag into the Ethernet frame so one wire can multiplex many VLANs. Before this, every VLAN needed its own dedicated cable.

20. create a router subinterface for VLAN 10 — router-on-a-stick int gi0/1.10

    Router-on-a-stick: one physical router port, split into logical subinterfaces, one per VLAN, each routing for its own subnet.

21. tell the subinterface which VLAN tag it handles encapsulation dot1Q 10

    The subinterface is invisible to 802.1Q on its own — encapsulation dot1Q binds it to a specific VLAN tag arriving on the trunk.

22. give VLAN 10's subinterface its gateway address ip address 10.10.0.1 255.255.255.0

    This address becomes VLAN 10's default gateway — every device on VLAN 10 points here to leave its own subnet.

23. create VLAN 20's subinterface int gi0/1.20

    Repeat the pattern per VLAN: one subinterface, one encapsulation, one IP. This scales to dozens of VLANs on a single physical port.

24. bind this subinterface to VLAN 20 encapsulation dot1Q 20

    Get the VLAN ID wrong here and traffic silently routes nowhere — a classic router-on-a-stick debugging trap.

25. give VLAN 20's subinterface its gateway address ip address 10.20.0.1 255.255.255.0

    Two subinterfaces, two subnets, one wire. This is the whole trick of inter-VLAN routing without a dedicated Layer-3 switch.

26. enable the OSPF routing process router ospf 1

    OSPF (RFC 2328) is a link-state protocol — every router builds a full map of the network instead of trusting hop-by-hop rumor the way older distance-vector protocols did.

27. advertise a connected network into OSPF area 0 network 10.10.0.0 0.0.0.255 area 0

    OSPF network statements use a WILDCARD mask, inverted from a subnet mask — 0.0.0.255 means "match the first 3 octets exactly, ignore the last."

28. step back out of router config to global config exit

    Same exit, same rule: one level at a time. config-router -> config, ready for the last unit — hardening.

29. set a hashed password required to reach privileged EXEC enable secret cisco123

    "enable secret" (hashed) superseded the older "enable password" (plaintext) years ago — never use the plaintext form on a real device.

30. configure the 5 virtual terminal lines used for remote (Telnet/SSH) access line vty 0 4

    vty 0 4 is five simultaneous remote sessions (lines 0 through 4) — the classic default before larger vty pools became common.

31. set the password required on incoming vty (remote) sessions password vtypass123

    Without a vty password, IOS refuses remote connections outright — an unconfigured line is a closed door, not an open one.

32. obscure plaintext passwords stored in the config with a weak reversible cipher service password-encryption

    Type-7 encryption is trivially reversible (tools crack it in seconds) — it stops shoulder-surfing, not a real attacker. enable SECRET (hashed) is what actually matters for real security.

33. jump directly back to privileged EXEC from any config submode, ready to save end

    end is this sim's equivalent of Ctrl-Z on a real terminal — it exits config mode entirely in one keystroke, no matter how deep you are nested.

34. save running-config to startup-config (NVRAM) so it survives a reload wr

    "wr" (write) is a decades-old reflex: type it after every change. Forget it once, and a power blip erases a whole afternoon of work.

35. Boss missionFINAL CHECK — confirm both VLAN 10 (10.10.0.0/24) and VLAN 20 (10.20.0.0/24) appear as directly connected networks, proving inter-VLAN routing works end to end sh ip route

    Two access VLANs, one 802.1Q trunk, one router-on-a-stick with two subinterfaces, OSPF advertising VLAN 10 — this is the smallest topology that proves Layer 2 and Layer 3 working together. This is the exam: doing beats recall. Type sh ip route one last time and see both subnets connected.

Certificate

Nearby eras

All 25 eras in the Terminal Academy