Featured image

Table of Contents Link to heading

This guide covers first-time router configuration on Cisco IOS from console access through to production-ready hardening. Each section includes the relevant CLI commands and a verification step — in production, the verify commands matter as much as the configuration commands. An unverified config is an assumption.

Warning
All passwords and keys in this guide are illustrative placeholders. In production, use credentials that meet your organisation’s password policy, store them in a secrets manager or Ansible Vault, and never commit them to version control.

Console Access and CLI Entry Points Link to heading

Physical Connection Link to heading

  1. Connect your laptop to the router’s console port using a console cable (RJ45-to-DB9 or USB-to-Serial adapter).
  2. Open a terminal emulator (PuTTY, Tera Term, SecureCRT) with the following serial parameters: 
    Baud rate: 9600
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None
  3. Press Enter after connecting to get a prompt.

Access the Router CLI Link to heading

  1. Press Enter to enter User EXEC mode (> prompt).
  2. Type enable to enter Privileged EXEC mode (# prompt).

Verify Console Connection Link to heading 

show version
show running-config

Confirm the router model, IOS version, and that the running config reflects a clean baseline before making any changes.

Baseline Hardening: Hostname, Passwords, and Access Controls Link to heading

Set a Hostname Link to heading 

configure terminal
hostname MyRouter
exit

Verify Hostname Link to heading 

show running-config | include hostname

Secure Console Access Link to heading

Note
Console line access without authentication is a physical security risk. Always set a password on the console line, even in lab environments — establishing the habit matters.
configure terminal
line console 0
password Cisco123
login
exit

Verify Console Security Link to heading 

show running-config | section line console

Secure VTY Lines (Remote Access via SSH/Telnet) Link to heading 

configure terminal
line vty 0 4
password RemotePass
login
exit
Warning
This section configures VTY with a plaintext password, which supports both Telnet and SSH. See the SSH configuration section below to restrict VTY access to SSH only (transport input ssh) and use local username authentication instead of a shared line password — the preferred approach in any environment where Telnet is not explicitly required.

Verify VTY Security Link to heading 

show running-config | section line vty

Create a Strong Enable Password Link to heading 

configure terminal
enable secret SuperSecurePassword
exit

enable secret stores the password as an MD5 hash. Never use enable password — it stores credentials in plaintext in the running config.

Verify Enable Password Link to heading 

show running-config | include enable secret

Interface Configuration and IP Assignment Link to heading

Assign IP Addresses to Interfaces Link to heading 

configure terminal
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
ip address 10.0.0.1 255.255.255.0
no shutdown
exit

Verify Interface Configuration Link to heading 

show ip interface brief

All configured interfaces should show up/up. An interface in admin down state needs no shutdown; a down/down state indicates a physical layer issue.

Static Routing and OSPF Link to heading

Enable Static Routing Link to heading 

configure terminal
ip route 0.0.0.0 0.0.0.0 192.168.1.254
exit

Static routes are appropriate for simple topologies with a single upstream path. For networks with multiple paths or redundant uplinks, use a dynamic routing protocol.

Verify Routing Table Link to heading 

show ip route

The default route (0.0.0.0/0) should appear with the configured next-hop.

Enable Dynamic Routing (OSPF Example) Link to heading 

configure terminal
router ospf 1
network 192.168.1.0 0.0.0.255 area 0
network 10.0.0.0 0.0.0.255 area 0
exit
Tip
In multi-area OSPF deployments, assign a stable loopback address and set it as the OSPF router ID explicitly (router-id 1.1.1.1) rather than relying on the highest active interface IP. A loopback-based router ID remains stable across interface state changes and simplifies topology interpretation.

Verify OSPF Configuration Link to heading 

show ip ospf neighbor
show ip ospf interface

Established OSPF neighbours indicate successful adjacency formation. Confirm that all expected interfaces are participating in the correct areas.

DHCP Server Configuration Link to heading

Enable DHCP Server Link to heading 

configure terminal
ip dhcp excluded-address 192.168.1.1 192.168.1.10
ip dhcp pool LAN
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 8.8.8.8
exit

The ip dhcp excluded-address range reserves static assignment space. Configure this range to cover all infrastructure addresses in the subnet before defining the pool.

Verify DHCP Configuration Link to heading 

show ip dhcp binding
show ip dhcp pool

NAT/PAT for Internet Access Link to heading

Enable NAT for Internet Access Link to heading 

configure terminal
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/0
ip nat inside
exit
interface GigabitEthernet0/1
ip nat outside
exit

PAT (overload) maps multiple inside addresses to a single outside interface IP. Ensure the correct interface is marked ip nat outside — a misconfiguration here causes all NAT translations to fail silently.

Verify NAT Configuration Link to heading 

show ip nat translations
show ip nat statistics

ACLs and SSH Hardening Link to heading

Enable Access Control Lists (ACLs) Link to heading 

configure terminal
access-list 100 deny tcp any any eq 23
access-list 100 permit ip any any
interface GigabitEthernet0/0
ip access-group 100 in
exit

This ACL blocks inbound Telnet (TCP/23) while permitting all other traffic. Apply ACLs to the most specific interface and direction possible — inbound ACLs are evaluated before routing, outbound ACLs after.

Verify ACL Configuration Link to heading 

show access-lists
show ip interface GigabitEthernet0/0

Enable SSH for Secure Remote Access Link to heading 

configure terminal
crypto key generate rsa
ip ssh version 2
username admin secret SecureAdminPassword
line vty 0 4
transport input ssh
login local
exit
Note
Specify a key modulus of at least 2048 bits when prompted during crypto key generate rsa. SSH v2 requires a minimum of 768 bits, but 2048 is the current recommended minimum for production use. After configuring SSH, remove or disable Telnet access entirely on VTY lines.

Verify SSH Configuration Link to heading 

show ip ssh

QoS for Traffic Prioritisation Link to heading

QoS ensures latency-sensitive traffic — voice, video, interactive applications — receives forwarding priority over bulk data during periods of congestion. Without QoS, all traffic competes equally for bandwidth; with it, you control the outcome of that competition.

Enable QoS Globally Link to heading 

mls qos

Classify VoIP Traffic Using Access Lists Link to heading 

access-list 101 permit udp any any range 16384 32767

Define QoS Classes & Mark VoIP Traffic Link to heading 

class-map match-all VOICE
match access-group 101
exit

policy-map QOS-POLICY
class VOICE
priority percent 30
exit

Apply QoS Policy to Interfaces Link to heading 

interface GigabitEthernet0/1
service-policy input QOS-POLICY
exit

Verify QoS Configuration Link to heading 

show policy-map interface GigabitEthernet0/1
Tip
The priority command implements a Low Latency Queue (LLQ) that services VoIP traffic before other queues during congestion. Allocate no more than 33% of interface bandwidth to the priority queue — exceeding this threshold can starve other traffic classes, including routing protocol traffic.

IPSec VPN Configuration Link to heading

Enable IPSec VPN Link to heading 

crypto isakmp policy 10
encryption aes
hash sha
authentication pre-share
group 2
exit
Warning
Diffie-Hellman Group 2 (1024-bit) is considered weak by current standards. Use Group 14 (2048-bit) or higher in production deployments. Similarly, prefer AES-256 and SHA-256 over AES-128 and SHA-1 for new IKEv2 deployments.

Define Pre-Shared Key Link to heading 

crypto isakmp key MySecureKey address 0.0.0.0

Configure IPSec Transform Set Link to heading 

crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac

Apply VPN to an Interface Link to heading 

interface GigabitEthernet0/1
crypto map VPN-MAP
exit

Verify VPN Configuration Link to heading 

show crypto isakmp sa
show crypto ipsec sa

Both Phase 1 (ISAKMP SA) and Phase 2 (IPSec SA) should show QM_IDLE and active states respectively for established tunnels.

Redundancy Link to heading

First-hop redundancy protocols (HSRP, VRRP) provide transparent gateway failover for end hosts. When the active router fails, the standby takes over the virtual IP within seconds, with no reconfiguration required on end devices.

Configuring Hot Standby Router Protocol (HSRP) for Gateway Redundancy Link to heading

Enable HSRP on VLAN Interfaces Link to heading 

interface vlan 10
ip address 192.168.1.1 255.255.255.0
standby 1 ip 192.168.1.254
standby 1 priority 110
standby 1 preempt
exit

standby preempt ensures the higher-priority router reclaims the active role after recovering from a failure. Without it, the recovered router remains standby even if it has a higher priority than the current active.

Verify HSRP Status Link to heading 

show standby

For a detailed guide, check out this Cisco resource.

Configuring Virtual Router Redundancy Protocol (VRRP) for Redundant Gateways Link to heading

VRRP is an open standard equivalent to HSRP, appropriate for multi-vendor environments.

Enable VRRP on VLAN Interfaces Link to heading 

interface vlan 20
ip address 192.168.2.1 255.255.255.0
vrrp 1 ip 192.168.2.254
vrrp 1 priority 120
exit

Verify VRRP Status Link to heading 

show vrrp

For more details, check out this VRRP guide.

Configuring BGP Failover for Redundant Internet Connectivity Link to heading

Enable BGP and Define AS Number Link to heading 

configure terminal
router bgp 65001
bgp log-neighbor-changes
exit

Configure BGP Neighbour for Redundant ISP Connections Link to heading 

router bgp 65001
neighbor 192.168.1.2 remote-as 65002
neighbor 192.168.2.2 remote-as 65003
exit

Verify BGP Configuration Link to heading 

show ip bgp summary

For a comprehensive guide, check out this BGP redundancy tutorial.

SNMP for Network Monitoring Link to heading

Enable SNMP Link to heading

Warning
SNMP community strings are transmitted in cleartext in SNMPv1 and SNMPv2c. Use SNMPv3 with authentication and encryption (auth and priv modes) in any environment where management traffic traverses untrusted networks. If SNMPv2c is required for compatibility, restrict access with an ACL referencing only your authorised NMS hosts.
snmp-server community PublicString RO
snmp-server community PrivateString RW
snmp-server location DataCentre
snmp-server contact admin@company.com

Verify SNMP Configuration Link to heading 

show snmp community
show snmp location

NetFlow for Traffic Analysis Link to heading

Enable NetFlow Link to heading 

ip flow-export destination 192.168.1.150 9996
ip flow-export version 9
ip flow-cache timeout active 5

Verify NetFlow Configuration Link to heading 

show ip flow export
show ip cache flow

NetFlow data sent to a collector (e.g., ntopng, Grafana with flow plugin, Elastic) gives you per-flow traffic visibility that SNMP interface counters alone cannot provide.

Ansible Integration: SSH Service Account Setup Link to heading

Enable SSH for Automation Link to heading 

ip ssh version 2
username ansible secret SecureAutomation

Verify SSH Access for Automation Link to heading 

show ip ssh
Tip
Create a dedicated service account for Ansible (username ansible) with the minimum privilege level required for the playbooks that account will run. Avoid using your personal admin credentials in automation — service accounts are independently auditable, revocable, and don’t expose your credentials if an Ansible control node is compromised.

Multicast Routing with PIM Sparse Mode Link to heading

Enable PIM Sparse Mode for Multicast Routing Link to heading 

configure terminal
ip multicast-routing
interface GigabitEthernet0/1
ip pim sparse-mode
exit

Set Up a Rendezvous Point (RP) for Multicast Traffic Link to heading 

ip pim rp-address 192.168.1.1

Verify Multicast Configuration Link to heading 

show ip pim neighbor
show ip igmp groups

For more details, check out this guide.

Layer 2 and Layer 3 Security: MAC Filtering, IP Source Guard, DAI Link to heading

Enable MAC Address Filtering for Higher Security Link to heading 

mac address-table static 00e0.abcd.1234 vlan 10 interface GigabitEthernet0/1
mac address-table static 00e0.abcd.5678 vlan 20 interface GigabitEthernet0/2

Enable IP Source Guard to Prevent Spoofing Link to heading 

interface GigabitEthernet0/3
ip verify source
exit

IP Source Guard requires DHCP Snooping to be enabled and active on the interface’s VLAN. It drops packets whose source IP doesn’t match the DHCP binding table for that port, preventing IP spoofing by devices with static addresses not enrolled in the binding table.

Enable Dynamic ARP Inspection (Mitigate ARP Attacks) Link to heading 

ip arp inspection vlan 10
ip arp inspection vlan 20

Verify Security Features Link to heading 

show mac address-table static
show ip verify source
show ip arp inspection

Cloud Integration for Hybrid Networking Link to heading

Integrate External Multicast Services with AWS Link to heading 

ip igmp snooping
interface GigabitEthernet0/1
ip pim sparse-mode
exit

Verify AWS Multicast Integration Link to heading 

show ip pim neighbor
show ip igmp groups

For cloud integration strategies, check out this AWS guide.

IPv6 Routing and Interface Configuration Link to heading

Enable IPv6 Routing Link to heading 

configure terminal
ipv6 unicast-routing
exit

Assign IPv6 Addresses to Interfaces Link to heading 

interface GigabitEthernet0/0
ipv6 address 2001:db8:1::1/64
no shutdown
exit

interface GigabitEthernet0/1
ipv6 address 2001:db8:2::1/64
no shutdown
exit

Verify IPv6 Configuration Link to heading 

show ipv6 interface brief

VRF for Network Segmentation Link to heading

VRF creates multiple independent routing instances on a single physical router — each VRF has its own routing table, interfaces, and forwarding plane. Used for network segmentation, multi-tenant environments, and overlapping address space management.

Create a VRF Instance Link to heading 

configure terminal
ip vrf Customer_A
rd 100:1
exit

Assign VRF to an Interface Link to heading 

interface GigabitEthernet0/2
ip vrf forwarding Customer_A
ip address 192.168.10.1 255.255.255.0
exit
Warning
Assigning ip vrf forwarding to an interface removes its existing IP address. Configure the VRF assignment before the IP address, or re-apply the IP address after assigning the VRF.

Verify VRF Configuration Link to heading 

show ip vrf
show ip route vrf Customer_A

GRE Tunnel for Site-to-Site Connectivity Link to heading

GRE tunnels encapsulate routed traffic for transport across an IP network. GRE alone provides no encryption — for site-to-site security, combine GRE with IPSec (GRE over IPSec or DMVPN).

Create a GRE Tunnel Interface Link to heading 

interface Tunnel0
ip address 10.10.10.1 255.255.255.0
tunnel source GigabitEthernet0/0
tunnel destination 192.168.1.2
exit

Verify GRE Tunnel Link to heading 

show interfaces Tunnel0
show ip route

OSPFv3 for IPv6 Dynamic Routing Link to heading

Enable OSPFv3 Link to heading 

configure terminal
ipv6 router ospf 10
router-id 1.1.1.1
exit

Assign OSPFv3 to Interfaces Link to heading 

interface GigabitEthernet0/0
ipv6 ospf 10 area 0
exit

interface GigabitEthernet0/1
ipv6 ospf 10 area 0
exit

Verify OSPFv3 Configuration Link to heading 

show ipv6 ospf neighbor
show ipv6 ospf interface

Load Balancing Link to heading

Configuring Load Balancing with HSRP (Hot Standby Router Protocol) Link to heading

HSRP load balancing uses multiple HSRP groups with different active routers per group. Each VLAN’s default gateway points to a different virtual IP, effectively distributing traffic across both routers in steady state.

Enable Multiple HSRP Instances for Load Balancing Link to heading 

interface vlan 10
ip address 192.168.1.1 255.255.255.0
standby 1 ip 192.168.1.254
standby 1 priority 110
standby 1 preempt
exit

interface vlan 20
ip address 192.168.2.1 255.255.255.0
standby 2 ip 192.168.2.254
standby 2 priority 120
standby 2 preempt
exit

Verify HSRP Load Balancing Link to heading 

show standby brief

For a detailed guide, check out this tutorial.

Configuring Load Balancing with BGP (Border Gateway Protocol) Link to heading

Enable BGP and Define AS Number Link to heading 

router bgp 65001
bgp log-neighbor-changes
exit

Configure BGP Neighbour for Load Balancing Link to heading 

router bgp 65001
neighbor 192.168.1.2 remote-as 65002
neighbor 192.168.2.2 remote-as 65003
maximum-paths 2
exit

Verify BGP Load Balancing Link to heading 

show ip bgp summary

For more details, check out this Cisco guide.

Configuring Dual WAN Load Balancing Link to heading

Enable Dual WAN for Traffic Distribution Link to heading 

interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
exit

interface GigabitEthernet0/1
ip address 192.168.2.1 255.255.255.0
exit

Configure Load Balancing Mode Link to heading 

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1

Verify Dual WAN Load Balancing Link to heading 

show ip route

For a detailed setup, check out this ASUS guide.

Saving Configuration and Connectivity Tests Link to heading

Save Configuration to Startup-Config Link to heading 

write memory

or

copy running-config startup-config

Always save after completing a configuration session. An unsaved config is lost on reload — and unplanned reloads happen.

Verify Configuration Save Link to heading 

show startup-config

Testing Connectivity Link to heading 

ping 8.8.8.8
traceroute 8.8.8.8
Tip
After saving, schedule a configuration backup to an external server (copy startup-config tftp://backup-server/hostname-date.cfg). Local-only backups are lost with the device. Automating this step with Ansible or AWX on a scheduled basis ensures backups happen consistently without manual intervention.