Last updated: 23 October 2026. Applies to Cisco IOS and IOS XE routers (for example ISR 1000/4000 and Catalyst 8000 series) and to Cisco Packet Tracer labs.
A router is a specialised computer that forwards packets between networks. Like a PC, it has a CPU, memory, storage and an operating system; on Cisco devices that operating system is Cisco IOS (Internetwork Operating System), or IOS XE on most current models. This guide explains the router’s hardware components, how it boots, the IOS command modes, the commands you will use every day, and a secure starting configuration.
What is Cisco IOS?
Cisco IOS is the software that runs routing, switching, security and management functions on Cisco devices. It provides the command-line interface (CLI) used to configure everything from IP addresses to routing protocols and ACLs. IOS XE runs the same familiar CLI on top of a Linux-based system, which adds features such as programmability (NETCONF/RESTCONF) and a more modular software architecture. Commands in this guide work on both.
Router memory components
| Memory | Keeps content after power-off? | What it stores |
|---|---|---|
| ROM | Yes | Power-on self-test (POST), the bootstrap program and ROMMON, a minimal recovery environment |
| Flash | Yes | The IOS image(s); can hold more than one version so you can upgrade or roll back |
| NVRAM | Yes | The startup configuration (startup-config) and, on many platforms, the configuration register |
| RAM | No | The running IOS, the running configuration, routing tables, ARP cache and packet buffers |
The key idea: changes you make are applied to the running-config in RAM immediately, but they are lost on reboot unless you save them to the startup-config in NVRAM.
Router interfaces
- LAN/WAN interfaces: GigabitEthernet (for example
Gi0/0/0), 10-Gigabit, and on older routers FastEthernet and serial interfaces. - Logical interfaces: loopback (always up; used for router IDs and management), sub-interfaces (for inter-VLAN routing) and tunnels.
- Management ports: the console port (local access with a rollover or USB cable), the AUX port on older models, and a dedicated management Ethernet port on many current routers.
How a Cisco router boots
- POST: the hardware is tested from ROM.
- Bootstrap: the bootstrap program in ROM starts and reads the configuration register.
- Locate and load IOS: normally from flash (or as set by
boot systemcommands); it can fall back to a TFTP server, and if no image is found the router stops in ROMMON. - Load the configuration: IOS copies the startup-config from NVRAM into RAM. If there is none, it starts the initial configuration dialog (setup mode).
The configuration register: 0x2102 and 0x2142
| Value | Effect |
|---|---|
| 0x2102 | Normal boot: load IOS from flash and the startup-config from NVRAM |
| 0x2142 | Boot IOS but ignore the startup-config; used for password recovery |
Check the current value at the end of show version, and change it with config-register 0x2102 (takes effect at the next reload).
IOS command modes
| Mode | Prompt | How to enter | Used for |
|---|---|---|---|
| User EXEC | Router> | Log in | Basic monitoring |
| Privileged EXEC | Router# | enable | All show commands, copy, reload, debug |
| Global configuration | Router(config)# | configure terminal | Device-wide settings |
| Interface configuration | Router(config-if)# | interface Gi0/0/0 | IP addresses, ACLs, descriptions |
| Line configuration | Router(config-line)# | line vty 0 4 / line console 0 | Remote and console access |
| Router configuration | Router(config-router)# | router ospf 1 | Routing protocols |
Use exit to go back one level and end (or Ctrl+Z) to return to privileged EXEC. Press ? for help and Tab to complete commands. In configuration mode, prefix a show command with do (for example do show ip interface brief).
Essential show commands
Router# show version ! IOS version, uptime, memory, config register
Router# show ip interface brief ! every interface, its IP and up/down status
Router# show running-config ! current configuration in RAM
Router# show startup-config ! saved configuration in NVRAM
Router# show ip route ! routing table
Router# show interfaces Gi0/0/0 ! detailed counters and errors
Router# show flash: ! IOS images and files in flashA secure starting configuration
This baseline sets a hostname, strong passwords and SSH-only remote access. Replace the names, addresses and passwords with your own:
Router(config)# hostname R1
R1(config)# no ip domain-lookup
R1(config)# enable secret Use-A-Long-Unique-Passphrase
R1(config)# service password-encryption
R1(config)# banner motd # Authorised access only #
R1(config)# username admin privilege 15 secret Another-Long-Passphrase
R1(config)# ip domain-name example.local
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# line console 0
R1(config-line)# login local
R1(config-line)# exec-timeout 10 0
R1(config-line)# exit
R1(config)# line vty 0 4
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 10 0
R1(config-line)# exit
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# description LAN
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# end
R1# copy running-config startup-configUse secret rather than password, because password values are stored in weak, reversible formats. To limit SSH access to an admin subnet, add a standard ACL with access-class on the VTY lines.
Password recovery (overview)
- Connect to the console and power-cycle the router; send a Break signal during boot to enter ROMMON.
- Set
confreg 0x2142andreset, so the router boots without loading the saved configuration. - Enter privileged mode, then run
copy startup-config running-configto load the old configuration. - Set a new
enable secret, restoreconfig-register 0x2102, and save withcopy running-config startup-config.
Because anyone with console access can do this, routers must be kept in locked racks or rooms. Some platforms let you disable password recovery (no service password-recovery), which forces a configuration wipe instead.
Frequently asked questions
What is the difference between running-config and startup-config?
The running-config is the active configuration in RAM; the startup-config is the saved copy in NVRAM that loads at boot. Save with copy running-config startup-config (or write memory).
How do I practise Cisco IOS without a real router?
Use Cisco Packet Tracer (free with a Cisco Networking Academy account) or Cisco Modeling Labs / GNS3 with official images for more realistic labs.
Related: What is routing? · Routing protocols · CCNA interview questions
Need help with network security? We review router and firewall configurations, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.
