CCNA 200-301 Command Reference: The Only Cheat Sheet You’ll Ever Need (20 Pages of Exam-Critical Configs) + Video

By /

Listen to this Post

Featured Image

Introduction

The Cisco Certified Network Associate (CCNA) 200-301 certification remains one of the most respected entry-level networking credentials in the IT industry. Yet countless candidates fail not because they don’t understand routing protocols or switching concepts, but because they cannot recall the exact command syntax under exam pressure. A 20-page color-coded command reference—covering everything from IOS mode navigation to OSPF configuration, ACL deployment, and DHCP setup—bridges that gap between conceptual knowledge and practical CLI fluency. This guide distills the entire 200-301 blueprint into actionable, verified commands with real configuration examples and expected show command output.

Learning Objectives

  • Master the IOS mode hierarchy and navigate between User EXEC, Privileged EXEC, Global Configuration, and sub-configuration modes with confidence
  • Configure and verify static routing, single-area OSPFv2, VLANs, trunking, and inter-VLAN routing using Cisco IOS commands
  • Implement device security through SSH hardening, password protection, ACLs, and port security
  • Deploy IP services including DHCP, NAT (static, dynamic, and PAT), NTP, and Syslog
  • Develop troubleshooting muscle memory through show command interpretation and verification workflows
  1. The IOS Mode Hierarchy — Your First and Most Important Command Set

The Cisco IOS CLI is structured hierarchically, and reading the prompt is the fastest way to orient yourself when troubleshooting. Every CCNA candidate must internalize these modes and the commands to navigate between them.

Step-by-Step Mode Navigation:

Router> enable ! User EXEC → Privileged EXEC
Router configure terminal ! Privileged EXEC → Global Config
Router(config) interface g0/0 ! Global Config → Interface Config
Router(config-if) exit ! Back one level
Router(config) line console 0 ! Global Config → Line Config
Router(config-line) end ! Jump straight back to Privileged EXEC
Router

Mode Indicators at a Glance:

– `>` — User EXEC mode (limited monitoring only)
– “ — Privileged EXEC mode (full show commands, no config changes)
– `(config)` — Global Configuration mode (system-wide changes)
– `(config-if)` — Interface Configuration mode
– `(config-router)` — Routing protocol configuration mode

Why This Matters: You cannot configure anything if you cannot navigate. The `end` command is your emergency exit from any sub-mode—memorize it.

  1. Device Access & Basic Commands — The Commands You Will Type Constantly

Every session begins with access commands and ends with saving your work. These are the most frequently used commands in any network engineer’s career.

Navigation & Save Commands:

| Command | Description |

||-|

| `enable` | Moves from User EXEC to Privileged EXEC |

| `disable` | Returns to User EXEC |

| `configure terminal` | Enters Global Configuration mode |
| `exit` | Steps back one mode level |
| `end` | Jumps directly back to Privileged EXEC |
| `copy running-config startup-config` | Saves running config to NVRAM (survives reboot) |
| `reload` | Restarts the device — unsaved changes are lost |

Essential Show Commands (The Verification Backbone):

| Command | What It Reveals |

||–|

| `show running-config` | Active configuration in RAM |
| `show startup-config` | Saved configuration in NVRAM |
| `show version` | IOS version, uptime, hardware details |
| `show ip interface brief` | One-line IP and status summary per interface |
| `show ip route` | Complete routing table |
| `show interfaces` | Detailed status and counters per interface |
| `show cdp neighbors` | Directly connected Cisco devices |

| `show lldp neighbors` | LLDP-discovered neighbors |

Worked Example — Basic Device Setup:

Switch> enable
Switch configure terminal
Switch(config) hostname SW1
SW1(config) end
SW1 copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[bash]

Verification Output — `show ip interface brief`:

SW1 show ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 10.0.0.1 YES manual up up
GigabitEthernet0/1 unassigned YES unset administratively down down
Vlan1 unassigned YES unset down down

Troubleshooting Tip: A line reading “administratively down” almost always means a missing `no shutdown` command. Filter long output with show running-config | include ip route.

  1. Device Security — Passwords, SSH, and Line Protection

Securing device access is non-1egotiable in production networks and heavily tested on the CCNA exam.

Password & User Configuration:

SW1(config) enable secret Cisco123 ! Privileged EXEC password (encrypted)
SW1(config) username admin secret Admin123 ! Local user database entry
SW1(config) service password-encryption ! Encrypts all plaintext passwords

Console & VTY Line Protection:

SW1(config) line console 0
SW1(config-line) password ConsolePass
SW1(config-line) login
SW1(config-line) logging synchronous ! Prevents console messages from interrupting typing
SW1(config-line) exec-timeout 5 0 ! Auto-logout after 5 minutes of inactivity

SW1(config) line vty 0 4
SW1(config-line) password VtyPass
SW1(config-line) login
SW1(config-line) transport input ssh ! Restrict to SSH only (no Telnet)
SW1(config-line) exec-timeout 5 0

SSH Hardening (Critical for Exam and Real-World):

SW1(config) ip domain-1ame lab.local ! Required for RSA key generation
SW1(config) crypto key generate rsa modulus 2048
! The name for the keys will be: SW1.lab.local
! % The key modulus size is 2048 bits
SW1(config) ip ssh version 2
SW1(config) ip ssh authentication-retries 3
SW1(config) line vty 0 4
SW1(config-line) transport input ssh
SW1(config-line) login local ! Uses local username/password database

CAUTION: Never use Telnet in production. SSH version 2 is the minimum standard. The `modulus 2048` ensures secure key strength—anything lower is vulnerable.

4. Routing Commands — Static and OSPF Configuration

Routing is the heart of IP connectivity. The CCNA 200-301 exam tests both static routing and single-area OSPFv2 extensively.

Static Routing Configuration:

R1(config) ip route 192.168.2.0 255.255.255.0 10.0.0.2
! Destination network Subnet mask Next-hop IP
R1(config) ip route 0.0.0.0 0.0.0.0 10.0.0.254
! Default route — matches any destination not in the routing table

Verification: `show ip route` displays `S` next to static routes. If a route is missing, traffic goes nowhere.

OSPFv2 Single-Area Configuration:

R1(config) router ospf 1 ! Process ID (locally significant)
R1(config-router) router-id 1.1.1.1 ! Uniquely identifies the router in the OSPF domain
R1(config-router) network 10.0.0.0 0.0.0.255 area 0
R1(config-router) network 192.168.1.0 0.0.0.255 area 0
! network [network-address] [wildcard-mask] area [area-1umber]

Alternative Method (Interface Subcommands — Preferred in Modern IOS):

R1(config) interface GigabitEthernet0/0
R1(config-if) ip ospf 1 area 0
R1(config-if) interface GigabitEthernet0/1
R1(config-if) ip ospf 1 area 0

Verification Commands:

| Command | Purpose |

|||

| `show ip ospf neighbor` | Lists all OSPF neighbors and their adjacency state |
| `show ip ospf interface` | Shows OSPF settings per interface |
| `show ip route ospf` | Displays only OSPF-learned routes |

OSPF Verification Output Example:

R1 show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 1 FULL/DR 00:00:35 10.0.0.2 GigabitEthernet0/0

Key Insight: The neighbor state must be `FULL` for OSPF to exchange routes. If it shows `2-WAY` or EXSTART, there is an adjacency problem.

  1. Switching Commands — VLANs, Trunking, and Spanning Tree

Layer 2 switching accounts for a significant portion of the CCNA exam. VLAN configuration and trunking are foundational skills.

VLAN Creation:

SW1(config) vlan 10
SW1(config-vlan) name Engineering
SW1(config-vlan) vlan 20
SW1(config-vlan) name Finance
SW1(config-vlan) vlan 30
SW1(config-vlan) name HR
SW1(config-vlan) end

Access Port Assignment:

SW1(config) interface fastEthernet 0/1
SW1(config-if) switchport mode access
SW1(config-if) switchport access vlan 10
SW1(config-if) no shutdown

Trunk Port Configuration:

SW1(config) interface gigabitEthernet 0/1
SW1(config-if) switchport trunk encapsulation dot1q ! Required on some switches
SW1(config-if) switchport mode trunk
SW1(config-if) switchport trunk allowed vlan 10,20,30 ! Best practice: restrict allowed VLANs
SW1(config-if) no shutdown

Verification Commands:

| Command | What It Shows |

|||

| `show vlan brief` | Lists every VLAN and assigned ports |
| `show interfaces trunk` | Shows trunking ports and allowed VLANs |
| `show spanning-tree` | STP root bridge and port roles |
| `show spanning-tree vlan 10` | STP details for a specific VLAN |

Troubleshooting Wisdom: If a port isn’t passing traffic, `show vlan brief` is your first stop. If the port isn’t listed under the right VLAN—that’s your problem. For trunk issues, check `show interfaces trunk` on both switches—not just one.

  1. Access Control Lists (ACLs) — Traffic Filtering Fundamentals

ACLs are security rules that filter traffic entering or leaving a device. Every ACL contains permit or deny statements called Access Control Entries (ACEs).

Standard ACL (Filters by Source IP Only):

R1(config) access-list 10 permit 192.168.1.0 0.0.0.255
R1(config) access-list 10 deny any
R1(config) interface gigabitEthernet 0/0
R1(config-if) ip access-group 10 out
! Apply ACL to the interface in the outbound direction

Extended ACL (Filters by Source, Destination, Protocol, and Port):

R1(config) access-list 100 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq 80
R1(config) access-list 100 deny ip any any
R1(config) interface gigabitEthernet 0/0
R1(config-if) ip access-group 100 in

ACL Configuration Workflow:

  1. Plan the location and direction on the interface
  2. Create the ACL using `access-list` global configuration commands
  3. Enable the ACL on the interface with `ip access-group`

Critical Rules:

  • ACLs process statements in sequential order—first match wins
  • An implicit `deny any` exists at the end of every ACL
  • Standard ACLs (1-99) filter only by source IP
  • Extended ACLs (100-199) filter by source, destination, protocol, and port

7. NAT Commands — Static, Dynamic, and PAT

Network Address Translation conserves public IPv4 addresses and enables private networks to access the internet.

Static NAT (One-to-One Mapping):

R1(config) ip nat inside source static 192.168.1.10 200.0.0.10
R1(config) interface gigabitEthernet 0/0
R1(config-if) ip nat inside
R1(config-if) interface serial 0/0/0
R1(config-if) ip nat outside

Dynamic NAT (Pool of Public Addresses):

R1(config) ip nat pool PUBLIC_POOL 200.0.0.10 200.0.0.20 netmask 255.255.255.0
R1(config) access-list 1 permit 192.168.1.0 0.0.0.255
R1(config) ip nat inside source list 1 pool PUBLIC_POOL
R1(config) interface gigabitEthernet 0/0
R1(config-if) ip nat inside
R1(config-if) interface serial 0/0/0
R1(config-if) ip nat outside

NAT Overload / PAT (Most Common — One Public IP for Many Private Hosts):

R1(config) access-list 1 permit 192.168.1.0 0.0.0.255
R1(config) ip nat inside source list 1 interface serial 0/0/0 overload
R1(config) interface gigabitEthernet 0/0
R1(config-if) ip nat inside
R1(config-if) interface serial 0/0/0
R1(config-if) ip nat outside

Verification: `show ip nat translations` displays active NAT entries. `show ip nat statistics` shows hit counts and miss counts—critical for troubleshooting.

8. DHCP Commands — Automatic IP Address Assignment

Cisco IOS routers can act as DHCP servers, eliminating the need for a separate server in small to medium networks.

DHCP Server Configuration:

R1(config) ip dhcp pool INTERNAL
R1(dhcp-config) network 192.168.1.0 255.255.255.0
R1(dhcp-config) default-router 192.168.1.1
R1(dhcp-config) dns-server 8.8.8.8 8.8.4.4
R1(dhcp-config) lease 7
R1(dhcp-config) exit
R1(config) ip dhcp excluded-address 192.168.1.1 192.168.1.10
! Prevents the DHCP server from leasing statically assigned addresses

DHCP Relay (When DHCP Server is on a Different Subnet):

R1(config) interface gigabitEthernet 0/0
R1(config-if) ip helper-address 10.0.0.100
! Forwards DHCP broadcasts to the DHCP server at 10.0.0.100

Understanding DORA: DHCP operates through a four-step process—Discovery, Offer, Request, and Acknowledgment.

9. IPv6 Commands — The Future of Networking

IPv6 is no longer optional—it’s a required topic on the CCNA 200-301 exam.

Enabling IPv6 and Configuring Addresses:

R1(config) ipv6 unicast-routing ! Globally enables IPv6 routing
R1(config) interface gigabitEthernet 0/0
R1(config-if) ipv6 address 2001:db8:1234:1::1/64
R1(config-if) no shutdown
R1(config-if) ipv6 enable ! Automatically generates link-local address

IPv6 Static Routing:

R1(config) ipv6 route 2001:db8:1234:2::/64 2001:db8:1234:1::2
! ipv6 route [destination-1etwork/prefix] [next-hop-address]

IPv6 OSPFv3:

R1(config) ipv6 router ospf 1
R1(config-rtr) router-id 1.1.1.1
R1(config-rtr) exit
R1(config) interface gigabitEthernet 0/0
R1(config-if) ipv6 ospf 1 area 0

Verification: `show ipv6 route` displays the IPv6 routing table. `show ipv6 interface brief` shows IPv6 addresses per interface.

10. Wildcard Mask Quick Reference

Wildcard masks are the inverse of subnet masks and are used in OSPF `network` statements and ACLs.

| Subnet Mask | Wildcard Mask | Use Case |

|-||-|

| 255.255.255.0 | 0.0.0.255 | Match a /24 network |
| 255.255.255.252 | 0.0.0.3 | Match a /30 point-to-point link |
| 255.255.0.0 | 0.0.255.255 | Match a /16 network |
| 255.255.255.255 | 0.0.0.0 | Match a single host |

Calculation Rule: Wildcard mask = 255.255.255.255 – Subnet Mask

What Undercode Say

  • Key Takeaway 1: The difference between passing and failing the CCNA often comes down to CLI fluency—not conceptual understanding. This 20-page color-coded reference eliminates the “I know the concept but forgot the command” problem by organizing commands by priority and providing real worked examples.

  • Key Takeaway 2: Show commands are the most underutilized tool in a junior engineer’s arsenal. The five essential show commands—show ip interface brief, show ip route, show vlan brief, show interfaces trunk, and show running-config—solve 80% of troubleshooting scenarios when used in the correct sequence.

  • Analysis: The CCNA 200-301 blueprint has evolved to include automation, programmability, and security-driven design. While this guide focuses on core IOS commands, candidates must also understand REST APIs, JSON, and Cisco DNA Center concepts for next-generation networks. The command reference serves as the foundation—but the modern network engineer must build upon it with automation skills.

  • The color-coding system (IMPORTANT, MEMORIZE, CAUTION, FREQUENTLY USED) mirrors how experienced engineers mentally prioritize commands during troubleshooting. This cognitive shortcut is what separates efficient engineers from those who hunt through documentation for every command.

  • The inclusion of actual show command output in the reference is critical—knowing what “correct” looks like is as important as knowing how to configure. Many candidates configure correctly but fail to verify, leaving misconfigurations undetected.

  • Typing commands in Packet Tracer or CML builds muscle memory far more effectively than passive reading. The guide’s worked examples are designed to be reproduced line by line in a lab environment.

Prediction

  • +1 The demand for CCNA-certified professionals will continue growing as enterprise networks expand and legacy network engineers retire. The 200-301 certification remains the gold standard entry point for networking careers.

  • +1 Network automation and programmability skills will become increasingly integrated into CCNA-level roles. Candidates who combine CLI fluency with Python and Ansible knowledge will command higher salaries and faster career progression.

  • -1 The shift toward cloud-1ative networking and SD-WAN may reduce the emphasis on traditional CLI-based configuration in some enterprise environments. Engineers who rely solely on IOS commands without understanding automation frameworks risk becoming obsolete.

  • +1 Free, high-quality resources like this command reference democratize access to certification preparation, enabling a more diverse and skilled global network engineering workforce.

  • -1 The rapid pace of Cisco IOS updates and the introduction of IOS XE mean that command syntax and best practices evolve constantly. Candidates must verify that their study materials reflect the latest exam objectives—outdated references can lead to exam failure.

  • +1 The integration of security fundamentals (ACLs, port security, DHCP snooping, dynamic ARP inspection) into the CCNA blueprint reflects the industry’s recognition that network engineers are the first line of defense. This trend will continue, making CCNA an increasingly valuable credential for security-conscious organizations.

▶️ Related Video (76% Match):

https://www.youtube.com/watch?v=0eBQXPEsf58

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Gmfaruk Ccna – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: