Cisco Router Interface Configuration: A Complete CLI Guide

Last updated: October 2026 — corrected for technical accuracy and modernized for current best practice.

Configuring router interfaces correctly is one of the first real skills a CCNA candidate needs, and it’s also one of the easiest places to make a small mistake that causes a confusing failure later. This guide walks through interface types, the actual CLI steps, verification commands, and the troubleshooting logic you need — including a few details that are often left out of beginner guides and end up causing exactly the kind of “why isn’t this working” confusion this article exists to prevent.

Interface Types on a Cisco Router

Cisco router interfaces fall into three broad categories:

• Physical interfaces — GigabitEthernet, FastEthernet, and Serial interfaces correspond to actual physical ports on the device.
• Logical interfaces — Loopback interfaces, subinterfaces, and Tunnel interfaces exist only in software, with no corresponding physical port.
• Virtual interfaces — Port-channel (EtherChannel) interfaces bundle multiple physical interfaces together to act as one logical link.

Interface numbering follows a slot/port (and sometimes slot/module/port) convention that varies by chassis and installed modules — a fixed-configuration router might number interfaces simply as 0/0 and 0/1, while a modular chassis can use three-part names like 0/1/0 depending on which module occupies which slot. Always confirm actual interface names with show ip interface brief rather than assuming a naming pattern from a different device model.

Entering Configuration Mode

From privileged EXEC mode, enter global configuration mode:

Router> enable
Router# configure terminal
Router(config)#

Selecting an Interface

Router(config)# interface FastEthernet 0/0
Router(config-if)#

Substitute the actual interface type and number for your device — again, verify with show ip interface brief if you’re unsure what’s physically present.

Adding a Description

A clear description makes later troubleshooting significantly faster, especially on a router with many interfaces:

Router(config-if)# description Link to ISP - Circuit ID 44821

Assigning an IP Address

IPv4:

Router(config-if)# ip address 192.168.1.1 255.255.255.0

IPv6: IPv6 requires enabling unicast routing globally first, then assigning the address on the interface:

Router(config)# ipv6 unicast-routing
Router(config)# interface FastEthernet 0/0
Router(config-if)# ipv6 address 2001:db8:100::1/64

It’s also worth configuring an IPv6 link-local address explicitly in production environments, since several IPv6 features (like certain routing protocol neighbor relationships) rely on link-local addressing specifically rather than the global unicast address.

Enabling the Interface

Most Cisco router physical interfaces are administratively shut down by default — though this isn’t universal across every platform and interface type, so don’t assume it without checking. Bring the interface up with:

Router(config-if)# no shutdown

You’ll typically see a syslog message confirming the state change:

%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up

Verifying the Configuration

Router# show ip interface brief
Router# show interfaces
Router# ping 192.168.1.2
Router# show running-config
Router# show startup-config

A successful ping returns five exclamation points (!!!!!). One useful detail many guides skip: you don’t have to leave configuration mode to run verification commands. Prefixing a command with do runs it directly from config mode:

Router(config-if)# do show ip interface brief

This saves a step when you’re actively configuring and want to check your work without exiting config mode first.

Global Settings Worth Configuring Alongside Interfaces

Router(config)# hostname EdgeRouter1
Router(config)# enable secret YourStrongPasswordHere
Router(config)# no ip domain-lookup

no ip domain-lookup prevents the router from trying to resolve mistyped commands as DNS lookups — without it, a typo at the command line can leave you waiting for a DNS timeout before the router tells you the command wasn’t recognized.

A current best practice this guide should flag directly: manage the router over SSH rather than Telnet. Telnet sends credentials and session traffic in plaintext; SSH encrypts both. Configuring SSH access (domain name, RSA key generation, VTY line configuration set to transport input ssh) is outside the scope of interface configuration specifically, but it’s a standard next step after getting interfaces up, and worth doing before this router is exposed to anything beyond a lab environment.

Router-on-a-Stick: Subinterfaces for Inter-VLAN Routing

Subinterfaces let a single physical interface carry traffic for multiple VLANs, each with its own IP address. This is the “router-on-a-stick” design, commonly used when a router doesn’t have enough physical ports for one per VLAN.

Router(config)# interface FastEthernet 0/0
Router(config-if)# no shutdown
Router(config-if)# exit
Router(config)# interface FastEthernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config)# interface FastEthernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

This is the step most guides on this topic skip, and it’s the one that actually matters most: the parent physical interface (FastEthernet 0/0 in this example) needs no shutdown applied directly, and typically carries no IP address of its own — the subinterfaces handle addressing. If the parent interface is left administratively down, every subinterface built on top of it stays down too, regardless of how correctly the subinterfaces themselves are configured. This is one of the most common router-on-a-stick troubleshooting traps for anyone working through this configuration for the first time.

Troubleshooting Interface States

show ip interface brief reports two status fields, and the combination tells you where to look:

• Administratively down / down — the interface has been manually shut down (shutdown was configured, or no shutdown was never applied). Fix: no shutdown.
• Down / down — the interface is enabled in software but has no physical connectivity (unplugged cable, bad cable, far-end device powered off, or a matching duplex/speed mismatch on some platforms). Fix: check the physical layer first.
• Up / up with no connectivity — the interface is fully operational at both layers, but you can’t reach anything beyond it. Check IP addressing, VLAN/subinterface configuration, routing, and any access lists before assuming a layer 1/2 problem.

Worked Example: Configuring a LAN and WAN Interface

Router(config)# interface GigabitEthernet 0/0
Router(config-if)# description LAN Interface
Router(config-if)# ip address 192.168.1.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# exit
Router(config)# interface GigabitEthernet 0/1
Router(config-if)# description WAN Interface to ISP
Router(config-if)# ip address 203.0.113.2 255.255.255.252
Router(config-if)# no shutdown
Router(config-if)# exit
Router(config)# end
Router# copy running-config startup-config

copy running-config startup-config and the older write memory both save the running configuration to NVRAM — they do the same thing, but copy running-config startup-config is the current, more explicit form and the one worth using going forward.

After bringing both interfaces up, confirm the router actually has a route out before assuming the configuration is complete:

Router# show ip route

If this is meant to be the router’s only path out and no static or dynamic routing has been configured yet, you’ll need a default route or routing protocol in place before traffic actually passes — interface configuration alone gets the links up, not necessarily the end-to-end path.

Frequently Asked Questions

Can I access a Cisco router remotely for interface configuration?

Yes, over SSH (after configuring VTY lines, a domain name, and RSA keys) or through a legacy Telnet session — SSH is the current best practice since it encrypts the session rather than sending credentials in plaintext.

How does a router get an IP address automatically?

A router interface can request an address via DHCP with ip address dhcp under interface configuration, though static addressing (as covered above) is more common on router interfaces specifically, since routers typically sit at network boundaries where a stable, known address matters.

How do I secure a configured interface?

Use enable secret for privileged access, SSH instead of Telnet for remote management, access control lists to restrict traffic where appropriate, and no ip domain-lookup to avoid DNS-lookup delays on command typos. Physically securing the device and limiting who has console access matters too.

What does interface range do, and does it work the same way everywhere?

interface range lets you apply the same configuration to multiple interfaces at once (for example, interface range FastEthernet 0/1 - 24) instead of configuring each one individually. The exact syntax and which interface types support it can vary by platform, so check your specific device’s command reference rather than assuming the range syntax is universal.

Do subinterfaces need their own no shutdown?

Subinterfaces are generally up as long as the parent physical interface is administratively up — the critical step is making sure the parent interface has no shutdown applied, since subinterfaces inherit that interface’s physical/administrative state.

Why would an interface show as “down, down” instead of “administratively down, down”?

“Administratively down” specifically means someone (or a default configuration) issued shutdown. Plain “down/down” without the “administratively” qualifier means the interface is enabled in software but isn’t detecting a live physical connection — check the cable, the far-end device, and speed/duplex settings before checking the configuration again.