cisco Cisco Networking Beginner Guide

1. What Even Is This Module?
2. Save Often: Your Safety Net
3. Networking 101: Routers, Switches, and Why We Secure Them
4. The Command-Line "Levels" (Modes)
5. Your First Commands: Hostname and Basic Navigation
6. Locking the Front Door: Enable Secret & Password Encryption
7. Banner: The "No Trespassing" Sign
8. Securing Console and VTY (Remote Access) Lines
9. SSH: Secure Remote Login
10. Port Security: Locking Down Switch Ports
11. Shutting Down Unused Ports
12. Access Control Lists (ACLs): Traffic Bouncers
13. Saving Your Work for Real
14. Checking Your Work: show Commands
15. Golden Rules for the Competition
16. Appendix: OSI Model, Simplified
17. Appendix: Subnetting, Simplified

In this CyberPatriot category, you're given a Packet Tracer file — a simulated network with routers, switches, computers, and sometimes servers — plus a list of questions and tasks. Some tasks ask you to type commands into a device to secure it (set a password, block unwanted traffic, etc.). Others are just written/multiple-choice questions about networking concepts.

Unlike the Windows/Linux competition images, this isn't a program silently scoring you in the background the whole time — it's closer to a guided worksheet: read a question, do the task, move to the next one.

Beginner tip: Don't panic if a command doesn't work the first time. Typos are extremely common when you're new to the CLI (command-line interface). Read the error message, check your spelling and spacing, and try again — nothing bad happens from a rejected command.

Before you type a single configuration command, learn this habit — it will save you more grief than any single security setting.

In Packet Tracer, go to File → Save As and save the .pkt file under a new name (e.g., Practice1_start.pkt) before you make any changes. Then save-as again under a new incrementing name after each big step (e.g., Practice1_v1.pkt, Practice1_v2.pkt). If you accidentally break something — lock yourself out of a device, cut off connectivity — you can simply close without saving and reopen your last good version instead of starting the whole exercise over.

On the routers/switches themselves, get in the habit of typing copy running-config startup-config (explained in Section 13) often, not just at the very end. Devices can lose all unsaved configuration if they restart.

Before touching any commands, it helps to know what the devices in front of you actually do.

• A switch connects devices within the same local network (for example, all the computers in one room or building) and forwards data based on MAC addresses (a unique hardware ID burned into every network card). Think of a switch as a mail sorter for one building.
• A router connects different networks together (for example, your local network to the internet, or one VLAN to another) and forwards data based on IP addresses. Think of a router as the post office that routes mail between different buildings/cities.
• A hub (rarely used today) is a dumb, older device that just repeats every signal to every port — no intelligence, no addressing. You likely won't configure one, but you may be asked a conceptual question about it.

Why do we secure these devices at all? Routers and switches are the "front door" of a network — whoever controls them can see, redirect, or block all the traffic passing through. A misconfigured or unsecured router/switch (default passwords, open remote access, no traffic filtering) is one of the easiest ways for an attacker to compromise an entire network. That's exactly what this module is testing you on: can you find and fix those weaknesses?

Cisco devices don't give you full control the instant you connect — you move through a series of "modes," each unlocking more power and more commands. This is similar in spirit to how a regular user account on a computer can't install software, but an administrator account can.

The prompt (the text right before your cursor) always tells you which mode you're in:

Router> enable
Router# configure terminal
Router(config)# interface gigabitEthernet0/0
Router(config-if)# exit
Router(config)# line console 0
Router(config-line)# exit
Router(config)# exit
Router#

Why does "privileged" mode exist and why is it locked behind enable? It's a safety gate. User EXEC mode lets anyone connected do harmless things like check status, but anything that could change the device's behavior — and therefore its security — requires proving you're an authorized administrator first. That's the entire idea behind the password you'll set on enable in Section 6.

enable              (go from User EXEC into Privileged EXEC)
disable             (go back down to User EXEC)
configure terminal  (go from Privileged EXEC into Global Config)
exit                (go up/out one level)
end                 (jump straight back to Privileged EXEC from anywhere — shortcut)

Giving the device a real name (instead of the generic default Router or Switch) is usually the very first configuration task, and it's required later for SSH to work.

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)#

Notice the prompt itself changed from Router(config)# to R1(config)# the instant you set the hostname — that's normal and expected.

Remember from Section 4 — Privileged EXEC mode (where all the real configuration power lives) is locked behind the enable command. Right now, anyone could type enable and get in with no password at all. Let's fix that.

R1(config)# enable secret Str0ngP@ss!

There are two similar-looking commands — always use enable secret, never enable password:

• enable secret — stores the password encrypted (hashed) in the configuration. Even if someone views the config file, they can't easily read the real password back out. Use this one.
• enable password — stores the password as plain, readable text (or only weakly scrambled). Anyone who can see the configuration can read the password directly. Avoid this one.

Next, encrypt any other passwords you set (like line passwords) so they're not sitting in plain text in the config either:

R1(config)# service password-encryption

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# enable secret Str0ngP@ss!
R1(config)# service password-encryption

A banner is a message displayed to anyone connecting to the device, before they even log in. In real networking (and in this competition), you're expected to display a legal warning notice — not a friendly greeting.

R1(config)# banner motd #AUTHORIZED ACCESS ONLY. ALL ACTIVITY IS MONITORED AND LOGGED.#

• motd stands for "Message Of The Day."
• The # symbols mark the start and end of your message — you can use any character that doesn't appear inside your message itself.

Beginner tip: Never write a welcoming banner like "Welcome to Router1!" A friendly greeting can be read as an invitation for anyone (including someone who shouldn't be there) to log in. Warning banners should sound like a "No Trespassing" sign, not a "Welcome Mat."

• Set a legal warning banner (banner motd) on every device.

There are two main ways someone logs into a router or switch:

• Console — a direct physical/cable connection (in real life, a cable plugged straight into the device). In Packet Tracer, this is like connecting a PC to the device with a console cable.
• VTY (Virtual Teletype) — remote access over the network, using Telnet or SSH, as if you were connecting from across the building (or across the internet).

Both need a password, or nobody protects your device even after you've locked enable.

R1(config)# line console 0
R1(config-line)# password ConsoleP@ss
R1(config-line)# login
R1(config-line)# exec-timeout 5 0
R1(config-line)# exit

• password <text> sets what the line will ask for.
• login tells the device to actually require that password before letting someone in (without login, the password you set is ignored!).
• exec-timeout 5 0 automatically disconnects an idle session after 5 minutes 0 seconds — so a login left open unattended doesn't stay open forever.

Checkpoint: If you're connected to the device remotely (over Telnet/SSH) rather than through the console, a mistake in this section can accidentally disconnect your own session. Save your .pkt file first (see Section 2), and double-check your commands before pressing Enter.

VTY lines work almost the same way, but there can be several of them (commonly numbered 0 through 4, or 0 through 15) — make sure you configure all of them, not just the first few:

R1(config)# line vty 0 15
R1(config-line)# password VtyP@ss
R1(config-line)# login
R1(config-line)# exec-timeout 5 0
R1(config-line)# exit

• Set a password + login on line console 0.
• Set a password + login on the full VTY range (e.g., line vty 0 15).
• Set exec-timeout on both.

Telnet (the classic way to remotely log into a device) sends everything — including your password — as plain, unencrypted text over the network. Anyone "listening" on that network could read your password directly. SSH (Secure Shell) does the same job but encrypts everything, so it's the standard we always use instead.

Setting up SSH requires a few pieces in a specific order:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# ip domain-name cyberpatriot.local
R1(config)# username admin privilege 15 secret Str0ngP@ss!
R1(config)# crypto key generate rsa modulus 1024
R1(config)# ip ssh version 2
R1(config)# line vty 0 15
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 5 0
R1(config-line)# exit

What each piece does:

• hostname and ip domain-name — SSH keys are generated using the device's name and domain, so both must be set first.
• username admin privilege 15 secret ... — creates an actual user account (with a proper hashed password) that people log in as, instead of everyone sharing one line password.
• crypto key generate rsa modulus 1024 — generates the encryption key pair SSH needs to work. (You'll see 2048 used in more advanced material — a larger number is more secure but takes a bit longer to generate; either works for learning.)
• ip ssh version 2 — makes sure the device uses the modern, more secure version of SSH.
• login local — tells the VTY lines to check the username database (the account you just created) instead of one shared line password.
• transport input ssh — this is the important security step: it tells the VTY lines to accept only SSH connections, and refuses Telnet entirely.

Beginner tip: If you skip transport input ssh, the device may still quietly accept unencrypted Telnet connections even though you've set up SSH. Always explicitly turn Telnet off this way.

• Set hostname and ip domain-name before generating keys.
• Create a real user account with secret (not password).
• Generate the RSA key and enable ip ssh version 2.
• Set login local and transport input ssh on the VTY lines.

Imagine someone walks up to an empty network jack in a wall and plugs in their own laptop. If that port is active and untouched, they're instantly on your network. Port security limits which/how many devices are allowed to use a given switch port.

Switch(config)# interface fastEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 1
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation shutdown
Switch(config-if)# exit

What each line means:

• switchport mode access — tells the switch this port connects to a single end device (like a PC), not another switch.
• switchport port-security — turns the feature on for this port.
• switchport port-security maximum 1 — only 1 device (1 MAC address) is allowed to use this port at a time.
• switchport port-security mac-address sticky — instead of you typing in the exact allowed MAC address by hand, the switch automatically "remembers" the first device it sees on this port and locks it in.
• switchport port-security violation shutdown — if a different device tries to use this port (like someone unplugging the real PC and plugging in their own laptop), the port automatically shuts itself off.

You can apply this to a whole range of ports at once instead of typing it repeatedly:

Switch(config)# interface range fastEthernet0/1 - 9
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport port-security
Switch(config-if-range)# switchport port-security maximum 1
Switch(config-if-range)# switchport port-security mac-address sticky
Switch(config-if-range)# switchport port-security violation shutdown
Switch(config-if-range)# exit

• Apply port security to every switch port that has a real device (PC, printer, etc.) plugged into it.

Any switch or router port with nothing legitimately connected to it should simply be turned off. An open, active, unused port is free network access for anyone who finds it.

Switch(config)# interface range fastEthernet0/10 - 24
Switch(config-if-range)# shutdown
Switch(config-if-range)# description UNUSED_DISABLED
Switch(config-if-range)# exit

• shutdown administratively turns the port off (as opposed to no shutdown, which turns a port on).
• description just labels the port with a note for yourself/other admins — it doesn't affect security directly, but it makes your work easy to review later.

Beginner tip: Look at the topology diagram in Packet Tracer and compare it against the switch's ports. Any port with no cable drawn to a device is a candidate to be shut down. This is one of the fastest, easiest wins in the whole exercise.

• Identify every unused port on every switch and router in the topology.
• shutdown each one.

Concept first, syntax second. An ACL (Access Control List) is like a bouncer's list at a club door: a set of rules, checked in order from top to bottom, that decide whether a piece of network traffic is allowed through or turned away. Once traffic matches a rule, the router stops checking further rules and either lets it through (permit) or blocks it (deny).

There's one critical rule to memorize:

Every ACL has an invisible final rule: "deny everything else." Even if you never type it, it's always there at the end. If you write an ACL with only deny rules and no permit rule, you will block all traffic — including traffic you meant to allow.

There are two basic kinds:

• Standard ACL — can only look at where traffic is coming from (source address). Simple, but less precise.
• Extended ACL — can look at where it's coming from AND going to, plus the type of traffic (e.g., web browsing vs. email). More precise, more commonly used for specific rules.

R1(config)# access-list 10 permit 192.168.1.0 0.0.0.255
R1(config)# access-list 10 deny any

R1(config)# interface gigabitEthernet0/0
R1(config-if)# ip access-group 10 in
R1(config-if)# exit

Everything you type into a device lives in something called the running configuration — but this only exists in the device's memory while it's powered on. If the device restarts (or Packet Tracer glitches, or your session times out), anything not saved is gone.

R1# copy running-config startup-config

You'll sometimes see this shortened to wr mem (short for "write memory") — it does the same thing.

Final checkpoint: Before you consider a device (or the whole exercise) finished, run copy running-config startup-config on every single device you touched, and do one last Save-As on the .pkt file itself. It is very easy to do great work and lose credit for it simply because it was never saved.

• Run copy running-config startup-config after finishing each device, not just at the very end.
• Do a final Save-As on the .pkt file when you're done.

After making any change, get in the habit of checking that it actually worked. show commands display information without changing anything, so they're always safe to run.

show running-config              (see the entire current configuration)
show ip interface brief          (quick view of every interface — up/down, IP address)
show vlan brief                  (list of VLANs and which ports belong to them)
show port-security interface fastEthernet0/1   (check port security status on one port)
show access-lists                (see your ACLs and their rule counts)
show ip ssh                      (confirm SSH is enabled and which version)

Beginner tip: show running-config can be long. If you only care about one part, use the pipe filter, e.g. show running-config | section line vty to see just the VTY line settings.

• After every change, use the matching show command to confirm it actually took effect.

• Read the entire question packet before touching anything. Later questions sometimes explain details (like IP addressing) that you need for earlier tasks.
• Don't break things that are supposed to work. The goal is to secure the network, not to disconnect everything. After each change, double check that legitimate devices can still communicate (ping, browse, etc.) unless the question specifically asks you to block that traffic.
• Save constantly — both the .pkt file (Save-As with a new name) and each device's configuration (copy running-config startup-config). See Sections 2 and 13.
• Work through every device, not just the one mentioned in the current question — the same kind of vulnerability (weak password, open port, missing banner) is often repeated across multiple devices.
• When a command fails, read the error message. Cisco IOS errors are usually specific about what went wrong (bad syntax, wrong mode, incomplete command) — use ? to check what's valid right where you are.
• It's okay to not know something. Use ? at any prompt to see valid next commands, and don't be afraid to ask a teammate or mentor.

Written questions often ask about "layers" of networking. The OSI model is a 7-layer way of describing how network communication is broken into stages, from the physical wire up to the application you're using.

Quick device mapping (a common question style):

• Hub → Layer 1 (just repeats electrical signals, no intelligence)
• Switch → Layer 2 (uses MAC addresses to forward data within a network)
• Router → Layer 3 (uses IP addresses to forward data between networks)

Memory trick (top to bottom): All People Seem To Need Data Processing (Application, Presentation, Session, Transport, Network, Data Link, Physical).

An IP address plus a subnet mask describes both a specific device and the network it belongs to. A /24 network (mask 255.255.255.0) is the one you'll see most often as a beginner — it means the first three numbers of the IP address identify the network, and the last number identifies the individual device.

Common private address ranges you'll see inside Packet Tracer topologies (these are never used directly on the public internet):

• 10.0.0.0 – 10.255.255.255
• 172.16.0.0 – 172.31.255.255
• 192.168.0.0 – 192.168.255.255

Once you're comfortable with the basics above, the master checklist has a full subnetting/CIDR reference table and step-by-step subnetting math if a question needs you to calculate an exact range.

You're ready for the basics. Practice these commands a few times in a blank Packet Tracer file until they feel natural, then move on to the full master checklist for deeper hardening techniques (VLANs and trunk security, DHCP snooping, spanning tree hardening, routing protocol authentication, and more).