Basic Cisco Router Configuration: Complete Step-by-Step Guide

Different IP networks cannot communicate with each other without a router. Routers do this job by forwarding packets from one IP network to another using routing. Before a router can do any of this, some basic configuration is required. This guide covers the complete basic Cisco router configuration process, using Cisco Packet Tracer for simulation, though the same commands apply identically on real Cisco hardware.

---

Getting Started: Setup Mode and Command Modes

You can practice these configurations using network simulator software such as Packet Tracer, Boson, or GNS3, or on an actual Cisco device. When a new Cisco router boots up for the first time with no configuration found, it offers to walk the user through a list of setup prompts. Most Cisco professionals skip this initial setup wizard and configure the router manually via the command line instead, since manual configuration offers more precision and is what the CCNA exam and real-world administration both require.

If you decline the setup wizard, you land at the user EXEC mode prompt:

Router>

Cisco IOS supports several command-line interface modes:

• User EXEC Mode
• Privileged EXEC Mode
• Global Configuration Mode
• Interface Configuration Mode
• Sub-Interface Configuration Mode
• Setup Mode
• ROM Monitor Mode

Command Mode Reference Table

Mode	Prompt	How to Enter	How to Exit
User EXEC	Router>	Default on login	logout
Privileged EXEC	Router#	enable	disable
Global Configuration	Router(config)#	configure terminal	exit
Interface Configuration	Router(config-if)#	interface [type][number]	exit
Line Configuration	Router(config-line)#	line [type][number]	exit
Sub-Interface Configuration	Router(config-subif)#	interface [type][num].[subif]	exit
ROM Monitor	rommon>	Ctrl+Break during boot	reset or i

---

How to Change the Default Hostname

Changing the router’s name differentiates it from other devices on the network, which becomes essential once you are managing more than one router. By default, every Cisco router is named “Router.” The hostname command, entered in global configuration mode, changes this:

Router> enable
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# hostname R1
R1(config)#

• Router> — the initial prompt in user EXEC mode, where only limited commands are available
• enable — enters privileged EXEC mode, unlocking more advanced commands
• configure terminal — enters global configuration mode, where device-wide settings are changed
• hostname R1 — changes the router’s hostname from “Router” to “R1”
• R1(config)# — the prompt now reflects the new hostname, confirming the change succeeded

---

Securing the Console Port

The console line allows a user with physical access to connect directly to the router. By default, no password is configured on the console port, meaning anyone with a physical connection can access the device. Configuring a console password closes this gap.

R1(config)# line console 0
R1(config-line)# password Cisco123
R1(config-line)# login
R1(config-line)# exec-timeout 5 0
R1(config-line)# exit

• line console 0 — enters console line configuration mode; 0 refers to the single primary console
• password Cisco123 — sets the console access password
• login — tells the router to actually prompt for that password on connection; without login, a configured password is not enforced
• exec-timeout 5 0 — automatically logs out an idle console session after 5 minutes, a security best practice to prevent an unattended, unlocked session
• exit — returns to global configuration mode

---

Configuring Telnet Access (and Why SSH Is Preferred)

VTY lines are the virtual terminal lines used for remote access via Telnet or SSH. Most Cisco routers enable five VTY lines by default, numbered 0 through 4. If you attempt a remote connection to a router with no VTY password configured, you will see: “Password required, but none set.”

Basic Telnet Configuration (Shared Password)

R1(config)# line vty 0 4
R1(config-line)# password Cisco123
R1(config-line)# login
R1(config-line)# exit

• line vty 0 4 — selects all five VTY lines (0 through 4) for configuration
• password Cisco123 — sets the shared password required to connect
• login — enforces that password prompt on connection
• exit — returns to global configuration mode

This method works, but it has a significant limitation: every remote user shares the exact same password and identity. There is no way to tell which specific person connected, and if the shared password is ever compromised, every user’s access is compromised simultaneously. It is also, critically, Telnet, which transmits everything, including this shared password, in plain text over the network. Anyone capturing packets on the path between the client and the router can read the password directly.

Why SSH Should Replace Telnet

SSH (Secure Shell) encrypts the entire session, including authentication, protecting against the plain-text credential exposure that makes Telnet unsuitable for any production network. Configuring SSH requires a few additional one-time steps beyond what Telnet needs:

R1(config)# hostname R1
R1(config)# ip domain-name networkustad.local
R1(config)# username admin secret StrongPass2026
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local
R1(config-line)# exit

• ip domain-name networkustad.local — required before generating an RSA key; the router uses the hostname plus domain name to name the key
• username admin secret StrongPass2026 — creates a specific, named local user account with an encrypted password, giving each administrator their own credential rather than a shared one
• crypto key generate rsa modulus 2048 — generates the RSA key pair SSH needs; 2048 bits is the current recommended minimum
• ip ssh version 2 — explicitly forces SSHv2, since SSHv1 has known security weaknesses
• transport input ssh — restricts the VTY lines to SSH only, disabling Telnet on those lines entirely
• login local — tells the router to authenticate against the local username database rather than a single shared line password, so each administrator logs in with their own individual, accountable credential

This is the configuration that should be used in any network beyond a pure isolated lab exercise. The earlier Telnet-only example is worth understanding because Telnet still appears on the CCNA exam and in some legacy environments, but transport input ssh combined with login local is the practical, real-world standard.

---

Securing Privileged EXEC Mode

Privileged EXEC mode grants access to the router’s full command set, including the ability to view and change the running configuration, so it must be protected.

R1(config)# enable secret StrongEnable2026
R1(config)# service password-encryption

• enable secret StrongEnable2026 — sets the privileged EXEC password using a strong, one-way hash
• service password-encryption — applies a weak, reversible obfuscation (Cisco Type 7) to other plain-text passwords stored in the configuration, such as the console and VTY line passwords set earlier; this is better than nothing but should not be relied on as strong protection, since Type 7 encoding is trivially reversible with widely available tools

Important: do not configure both enable password and enable secret. Older documentation and tutorials sometimes show both commands together, for example enable password cisco followed by enable secret cisco1. If both are present, enable secret always takes precedence, and enable password is silently ignored. Configuring both does not provide layered security; it only creates confusion, since the enable password value has no actual effect once enable secret exists. This is a specific, testable CCNA fact: always use enable secret alone, and never rely on enable password on any router where enable secret is also configured.

---

Configuring a Login Banner

Cisco routers support two relevant banner types: MOTD (Message of the Day), which displays before login, and EXEC, which displays after a successful login. Packet Tracer supports only the MOTD banner for practice purposes; both use identical syntax on real hardware.

R1(config)# banner motd #
Enter TEXT message. End with the character '#'.
WARNING: Unauthorized access to this device is strictly prohibited. All activity is monitored and logged.
#

Security note on banner wording: never use a welcoming word like “Welcome” in a login banner. This is not just a stylistic preference; a banner that reads as an invitation can be used by a defendant’s legal counsel to argue that access was implicitly authorized, potentially undermining prosecution under computer fraud and unauthorized access laws. Banners should be unambiguous, formal warning statements, along the lines of the example above, stating clearly that access is restricted and monitored.

---

Enabling DNS Lookup for Hostname Resolution

To allow the router to resolve hostnames to IP addresses using a DNS server:

R1(config)# ip name-server 192.168.10.254
R1(config)# exit

• ip name-server 192.168.10.254 — sets the DNS server address the router will query for hostname resolution

---

Disabling Automatic Domain Lookup

By default, if you mistype a command, the router assumes the unrecognized word might be a hostname and tries to resolve it via DNS, sending a broadcast to 255.255.255.255. This causes a frustrating delay (often 30+ seconds) before the router gives up and reports the error. Disabling this behaviour is one of the most common and useful first steps in any lab session.

R1(config)# no ip domain-lookup

Immediately eliminates the delay caused by mistyped commands attempting DNS resolution.

---

Assigning a Local Name to an IP Address

You can map a hostname directly to an IP address on the router itself, useful for quickly testing connectivity or telnet/SSH access to a known device without relying on external DNS:

R1(config)# ip host R2 192.168.1.2
R1(config)# exit

• ip host R2 192.168.1.2 — assigns the name “R2” to IP address 192.168.1.2 locally on this router; you can now ping R2 or ssh R2 and the router will resolve it internally without querying any DNS server

---

Saving the Router Configuration

Changes made in the running configuration exist only in RAM and are lost on reboot unless explicitly saved to NVRAM.

R1# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]

The shorthand write memory (or its abbreviation wr) accomplishes the same result:

R1# write memory
Building configuration...
[OK]

Both commands can also be run directly from global configuration mode by prefixing them with do, which temporarily executes a privileged EXEC command without leaving configuration mode:

R1(config)# do write memory
Building configuration...
[OK]

Always save your configuration after making changes. An unsaved configuration is lost entirely on power loss or reload, forcing you to repeat every step above.

---

Top Mistakes to Avoid

1. Forgetting no shutdown on interfaces. Every physical interface on a Cisco router is administratively shut down by default. Configuring an IP address alone does not bring the interface up.
2. Using weak, guessable passwords. “cisco,” “password,” and “admin” are the first values any automated attack tries. Use unique, strong passwords even in lab environments to build the right habit.
3. Configuring both enable password and enable secret. As covered above, only enable secret takes effect; configuring both adds confusion with no security benefit.
4. Leaving Telnet enabled on production or exposed devices. Use transport input ssh to disable Telnet on VTY lines and rely on SSH with login local and named user accounts instead.
5. Not saving the configuration. copy running-config startup-config or write memory after every meaningful change; an unsaved configuration does not survive a reload.
6. Skipping the DNS lookup fix. no ip domain-lookup early in any lab session saves significant time lost to mistyped-command delays.

---

CCNA Exam Pointers

• enable moves from user EXEC to privileged EXEC; configure terminal moves from privileged EXEC to global configuration
• enable secret always overrides enable password when both are configured; never rely on enable password alongside enable secret
• service password-encryption applies weak, reversible Type 7 obfuscation, not strong encryption, to plain-text passwords in the configuration
• A configured password on a line has no effect unless paired with login (or login local)
• login authenticates against a single shared line password; login local authenticates against individually created username accounts, providing per-user accountability
• SSH requires: hostname set, ip domain-name set, username/secret created, crypto key generate rsa, then ip ssh version 2 and transport input ssh on the VTY lines
• MOTD banner displays before login; EXEC banner displays after login; never use “Welcome” in a security banner
• no ip domain-lookup disables the router’s default behaviour of trying to resolve unrecognized command input as a DNS hostname
• copy running-config startup-config and write memory both save the running configuration to NVRAM; do allows either to run from within global configuration mode
• Interfaces are administratively down by default; no shutdown is required to bring any interface up

---

Conclusion

Basic Cisco router configuration follows a consistent, logical sequence: set a hostname, secure the console and VTY lines, secure privileged EXEC mode with enable secret alone, configure a properly worded warning banner, clean up DNS lookup behaviour, and save the configuration.

The most important upgrade beyond the fundamentals covered in most introductory guides is replacing shared-password Telnet with SSH and named user accounts via login local, since this single change is what separates a lab exercise from a configuration suitable for any network with real exposure. Mastering this sequence, and understanding precisely why enable secret supersedes enable password, why banners should never sound welcoming, and why Telnet should not be the endpoint of your remote-access configuration, provides the solid foundation both the CCNA exam and real-world router administration require.

---

Frequently Asked Questions

What is the first command to enter global configuration mode on a Cisco router?

After reaching privileged EXEC mode with enable, type configure terminal (commonly abbreviated conf t). This command switches the router into global configuration mode, where device-wide settings such as the hostname, passwords, banners, and DNS settings are configured, and from which you can drop into more specific modes like interface or line configuration.

How do you assign an IP address to a router interface in Cisco IOS?

Enter global configuration mode with configure terminal, select the target interface with interface [type][number], for example interface GigabitEthernet0/0, then assign the address with ip address [IP] [subnet mask], for example ip address 192.168.1.1 255.255.255.0. Finally, issue no shutdown, since every physical interface is administratively down by default and will not pass traffic, regardless of IP configuration, until this command is entered.

What steps ensure a Cisco router configuration is saved permanently?

Use copy running-config startup-config, or its shorthand write memory (wr), to copy the active configuration from RAM into NVRAM, where it survives a reload or power loss. Both commands can also be executed directly from global configuration mode by prefixing them with do, avoiding the need to exit configuration mode first. Any configuration change not saved this way is lost the next time the router reboots.

Why is the enable secret command preferred over enable password?

The enable secret command stores the privileged EXEC password using a strong, one-way hash, making it resistant to casual recovery even if someone views the configuration file. The enable password command, by contrast, stores the password in plain text unless separately obfuscated with service password-encryption, and that obfuscation is only a weak, reversible encoding, not real encryption. More importantly, when both commands are configured on the same router, enable secret always takes precedence and enable password is completely ignored, so there is never a legitimate reason to configure both together; use enable secret alone.

How do you verify the active configuration after setting up a Cisco router?

Use show running-config to display the full active configuration currently held in RAM, show ip interface brief to see a compact list of every interface with its IP address and up/down status, and ping [IP address] to confirm actual connectivity to another device. For remote access verification specifically, show ip ssh confirms SSH is enabled and which version is active, and show line vty 0 4 confirms the authentication method configured on the VTY lines.

Should I configure Telnet or SSH for remote router access?

SSH should be used for any router with real network exposure, since it encrypts the entire session including login credentials, while Telnet transmits everything, including passwords, in plain text that can be captured by anyone monitoring the network path. Configuring SSH requires a few additional one-time steps beyond Telnet: setting a domain name with ip domain-name, creating a named user account with username, generating an RSA key pair with crypto key generate rsa modulus 2048, then applying transport input ssh and login local on the VTY lines. Telnet remains relevant to understand for the CCNA exam and for working with legacy equipment, but it should not be the remote-access method left active on any production or internet-reachable device.

What is the difference between login and login local on VTY lines?

login alone tells the router to prompt for the single shared password configured directly on that line with the password command; every remote user who knows that one password has identical, indistinguishable access. login local instead tells the router to authenticate against the local username database created with the username command, so each administrator logs in with their own individual credential. This matters both for security, since a compromised shared password affects every user simultaneously, and for accountability, since login local allows the router’s logs to show exactly which named user performed a given action, whereas a shared-password line cannot distinguish between users at all.