Cisco IOS & IOS-XE Command Handbook
Comprehensive field cheat sheet for Cisco IOS/IOS-XE: VLANs, Trunking, LACP, OSPF, NAT, Port Security, and HSRP.
Basic Hardening & SSH v2 Configuration
Configure hostname, encrypted enable secret, generate RSA keys, and enable SSH v2.
enable configure terminal hostname SW-CORE-01 ip domain-name tdnam.corp crypto key generate rsa modulus 2048 ip ssh version 2 username admin privilege 15 secret SuperSecretP@ss123 line vty 0 4 transport input ssh login local exec-timeout 5 0 exit service password-encryption
VLAN Creation & 802.1Q Trunk Port
Create data and voice VLANs and configure dot1q trunking between switches.
configure terminal vlan 10 name DATA_DEPT vlan 20 name VOICE_VOIP vlan 99 name MANAGEMENT exit interface GigabitEthernet0/1 description UPLINK-TO-DISTRIBUTION switchport mode trunk switchport trunk encapsulation dot1q switchport trunk allowed vlan 10,20,99 switchport trunk native vlan 99 no shutdown exit
Access Port with Voice VLAN for IP Phone
Configure dual access port supporting PC and IP Phone with QoS prioritization.
interface GigabitEthernet0/2 description PC-USER-DESK switchport mode access switchport access vlan 10 switchport voice vlan 20 spanning-tree portfast spanning-tree bpduguard enable no shutdown exit
Link Aggregation / EtherChannel (LACP)
Bundle multiple physical links into a single logical channel using open standard LACP.
interface range GigabitEthernet0/23 - 24 description BUNDLED-TO-CORE channel-group 1 mode active no shutdown exit interface Port-channel 1 switchport mode trunk switchport trunk allowed vlan all exit
OSPFv2 Dynamic Routing Protocol
Advertise internal subnets into Area 0 with custom router-id and passive interfaces.
router ospf 1 router-id 1.1.1.1 network 192.168.10.0 0.0.0.255 area 0 network 192.168.20.0 0.0.0.255 area 0 network 10.0.0.0 0.0.0.3 area 0 passive-interface GigabitEthernet0/1 auto-cost reference-bandwidth 1000 exit
NAT Overload (PAT) for Internet Access
Translate private RFC 1918 IPs to a single public IP using Port Address Translation.
access-list 1 permit 192.168.0.0 0.0.255.255 interface GigabitEthernet0/0 description LAN-INSIDE ip nat inside exit interface GigabitEthernet0/1 description WAN-INTERNET ip nat outside exit ip nat inside source list 1 interface GigabitEthernet0/1 overload ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 203.0.113.1
DHCP Server Pool & Relay (ip helper-address)
Configure on-box DHCP pool and forward DHCP broadcast via ip helper-address.
ip dhcp excluded-address 192.168.10.1 192.168.10.20 ip dhcp pool POOL_LAN_DEPT network 192.168.10.0 255.255.255.0 default-router 192.168.10.1 dns-server 1.1.1.1 8.8.8.8 lease 7 exit interface Vlan 10 description GATEWAY-VLAN-10 ip address 192.168.10.1 255.255.255.0 ip helper-address 192.168.1.100 exit
Switchport Port Security & Sticky MAC
Restrict physical port access to learned sticky MAC addresses and shutdown on violation.
interface GigabitEthernet0/5 switchport mode access switchport access vlan 10 switchport port-security switchport port-security maximum 1 switchport port-security mac-address sticky switchport port-security violation shutdown no shutdown exit # Khôi phục cổng bị err-disabled do vi phạm: # errdisable recovery cause psecure-violation # errdisable recovery interval 30
HSRP (Hot Standby Router Protocol) Redundancy
Configure active/standby virtual gateway redundancy with preemption and tracking.
interface Vlan 10 ip address 192.168.10.2 255.255.255.0 standby 10 ip 192.168.10.1 standby 10 priority 110 standby 10 preempt standby 10 track GigabitEthernet0/1 20 exit