Last updated 19 July 2026 · reviewed for accuracy

Cisco IOS basics & CLI modes

Every Cisco switch and router you will ever touch speaks the same command-line language. This lesson teaches you the thing the CLI never explains: which mode you are in, what each mode is allowed to do, and how to move between them without guessing.

The prompt tells you everything

In Cisco IOS, the prompt shows your current mode: a greater-than sign means user EXEC (look, but barely touch), a hash means privileged EXEC (see everything, erase anything), and (config) means global configuration mode (change the device). Reading the prompt is the first habit of anyone who works on Cisco gear.

IOS is a modal CLI: the same keystrokes mean different things depending on where you are standing. Fortunately the prompt always tells you where that is:

IOS modes at a glance
Prompt	Mode	What it can do
`Switch>`	User EXEC	Basic looking: ping, some show commands
`Switch#`	Privileged EXEC	All show commands, debug, copy, reload
`Switch(config)#`	Global configuration	Change device-wide settings
`Switch(config-if)#`	Interface configuration	Change one port or interface

Moving between modes

You move deeper with enable, configure terminal and interface commands, and back out with exit (one level) or end (straight back to privileged EXEC). Ctrl+Z does the same as end.

Here is a full round trip: the exact keystrokes, with the prompt changing at every step:

ios: consolemode round trip

! user EXEC → privileged EXEC → config → interface
Switch> enable
Switch# configure terminal
Switch(config)# interface FastEthernet0/1
Switch(config-if)# end
Switch#

Two exits are worth memorising: exit climbs one level up; end (or Ctrl+Z) jumps all the way back to privileged EXEC from anywhere. If a command is rejected with % Invalid input, check the prompt first: nine times out of ten you are simply in the wrong mode.

Getting help without leaving the CLI

The question mark is the built-in manual: typed alone it lists every command available in the current mode, and typed after a partial word it lists every completion. Tab completes an unambiguous partial command.

? on its own: list everything this mode accepts.
sh?: every command starting with sh.
show ?: every keyword that can follow show.
Commands can be abbreviated to their shortest unambiguous form: conf t is configure terminal; sh ip int br is show ip interface brief.

Two configs: running and startup

IOS keeps two configurations: running-config lives in RAM and changes the moment you type a command; startup-config lives in NVRAM and is what loads after a reboot. Nothing you type survives a power cycle until you copy running to startup.

This is the classic beginner trap. You configure a switch perfectly, it works for weeks, then a power blip erases everything, because the working config was never saved:

ios: consolesave your work

Switch# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]

Old hands type the shortcut wr (write memory). Either way: if you changed it and want to keep it, save it before you walk away.

This track builds on the concepts

Each Cisco lesson assumes the idea behind the commands. If VLANs or routing tables are still fuzzy, read VLANs & trunking and How routing decisions work first: the CLI makes much more sense when you know what it is configuring.

Frequently asked questions

What is the difference between user EXEC and privileged EXEC mode?

User EXEC (the > prompt) allows basic monitoring: ping and limited show output. Privileged EXEC (the # prompt, reached with enable) unlocks the full command set. Configuration changes need one level more: configure terminal.

Why did my configuration disappear after a reboot?

Commands change the running-config in RAM immediately, but only startup-config in NVRAM survives a reboot. If you never ran copy running-config startup-config, the device boots the last saved config, without your changes.

Can I practise IOS without buying a Cisco switch?

Yes: Cisco Packet Tracer is free and simulates switches and routers well enough for everything in this track. Every command in these lessons works in Packet Tracer; see Building a home lab.