Initial Router Configuration (Cisco CLI)
1. Basic Access
This section handles initial entry, naming, and basic security.
Router> enable # Enter privileged EXEC mode
Router# configure terminal # Global configuration mode
Router(config)# hostname R1 # Set router name
R1(config)# no ip domain-lookup # Disable DNS lookup
R1(config)# enable secret class123 # Encrypted enable password
R1(config)# service password-encryption # Encrypt plain-text passwords
R1(config)# banner motd ^ Unauthorized access is strictly prohibited! ^ # Login banner
2. Configure Management IP
Using a Loopback interface is recommended for stable management access.
! Use Loopback0 as management interface (Recommended)
R1(config)# interface loopback0
R1(config-if)# ip address [Link] [Link]
R1(config-if)# description MANAGEMENT - VLAN 99
R1(config-if)# no shutdown
R1(config-if)# exit
! Set default gateway (Next-Hop)
R1(config)# ip route [Link] [Link] [Link]
3. Secure Access (VTY Lines)
Restricting remote access using Access Control Lists (ACLs).
! Restrict remote access to specific network (Optional)
R1(config)# ip access-list standard MGMT
R1(config-std-nacl)# permit [Link] [Link]
R1(config-std-nacl)# deny any
R1(config-std-nacl)# exit
R1(config)# line vty 0 4
R1(config-line)# login local # Use local username
R1(config-line)# transport input ssh # Secure access only
R1(config-line)# access-class MGMT in # Apply ACL
R1(config-line)# exec-timeout 10 0 # 10 min timeout
R1(config-line)# exit
4. Create Local User (For SSH Login)
R1(config)# username admin privilege 15 secret Admin@123 # Strong local user
5. Configure SSH for Secure Access
R1(config)# ip domain-name [Link]
R1(config)# crypto key generate rsa # Recommended: 2048 bits
R1(config)# ip ssh version 2 # Use SSHv2 only
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exit
6. Configure Interfaces
Example: G0/0 to Switch (User LAN)
R1(config)# interface g0/0
R1(config-if)# description TO-SWITCH (USER LAN)
R1(config-if)# ip address [Link] [Link]
R1(config-if)# no shutdown
R1(config-if)# exit
Example: G0/1 to ISP / Next-Hop
R1(config)# interface g0/1
R1(config-if)# description TO-ISP
R1(config-if)# ip address [Link] [Link]
R1(config-if)# no shutdown
R1(config-if)# exit
7. Configure Routing (Example)
! Static Route Example
R1(config)# ip route [Link] [Link] [Link]
! OR Default Route
R1(config)# ip route [Link] [Link] [Link]
8. NAT Configuration (Basic Example)
Used to allow the internal LAN to access the Internet.
! Inside Interface
R1(config)# interface g0/0
R1(config-if)# ip nat inside
R1(config-if)# exit
! Outside Interface
R1(config)# interface g0/1
R1(config-if)# ip nat outside
R1(config-if)# exit
! NAT ACL
R1(config)# access-list 1 permit [Link] [Link]
! Overload (PAT)
R1(config)# ip nat inside source list 1 interface g0/1 overload
9. Save Configuration
R1# copy running-config startup-config # Save to NVRAM
10. Verification Commands
On Router:
• show ip interface brief — Interface status
• show ip route — Routing table
• show running-config — Running configuration
• show startup-config — Saved configuration
• show ip ssh — SSH status
• show ip nat translations — NAT table
• ping <ip-address> — Connectivity test
• traceroute <ip-address> — Path verification
On Remote (From PC):
• ping <router-management-ip> — Reachability
• ssh -l admin <router-management-ip> — SSH access