Speed Reference

cisco Cisco Networking Speed Reference

Condensed, no-explanation command sheet for when the clock is running.

Recall/scan sheet only — read the Master Checklist or Beginner Guide first. > user exec, # privileged exec, (config)# global config, (config-if)# interface config, (config-line)# line config.

0. Before Anything#

Save-as a new versioned copy of the .pkt file before making changes. copy run start often during work, not just at the end.

1. Full From-Scratch Hardening Template (router or switch)#

cisco-ios

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# ip domain-name cyberpatriot.local          # required before crypto key generate rsa works
R1(config)# enable secret Str0ngP@ss!
R1(config)# no enable password                          # remove if present alongside enable secret
R1(config)# service password-encryption
R1(config)# security passwords min-length 10
R1(config)# banner motd # AUTHORIZED ACCESS ONLY. ALL ACTIVITY IS MONITORED. #
R1(config)# no ip domain-lookup
R1(config)# no ip http server
R1(config)# no ip http secure-server
R1(config)# no cdp run
R1(config)# no ip source-route
R1(config)# no service tcp-small-servers
R1(config)# no service udp-small-servers
R1(config)# line console 0
R1(config-line)# password ConsoleP@ss
R1(config-line)# login
R1(config-line)# exec-timeout 5 0
R1(config-line)# logging synchronous
R1(config-line)# exit
R1(config)# line aux 0
R1(config-line)# no exec
R1(config-line)# transport input none
R1(config-line)# exit
R1(config)# username admin privilege 15 secret Str0ngP@ss!
R1(config)# crypto key generate rsa modulus 2048
R1(config)# ip ssh version 2
R1(config)# ip ssh timeout 60
R1(config)# ip ssh authentication-retries 3
R1(config)# line vty 0 15                                # ALL vty lines, not just 0 4 — 5-15 left open is a classic trap
R1(config-line)# login local
R1(config-line)# transport input ssh
R1(config-line)# exec-timeout 5 0
R1(config-line)# logging synchronous
R1(config-line)# exit
R1(config)# login block-for 120 attempts 3 within 60
R1(config)# end
R1# copy running-config startup-config

2. Switch Port Security#

cisco-ios

Switch(config)# interface range fa0/1 - 24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport port-security
Switch(config-if-range)# switchport port-security maximum 1
Switch(config-if-range)# switchport port-security mac-address sticky
Switch(config-if-range)# switchport port-security violation shutdown

Shut down every unused port. Move unused ports to an unused VLAN. Change native VLAN off VLAN 1 + switchport nonegotiate on trunks.

3. ACL Example (standard, applied to VTY)#

cisco-ios

R1(config)# access-list 10 permit 192.168.1.0 0.0.0.255
R1(config)# access-list 10 deny any log
R1(config)# line vty 0 15
R1(config-line)# access-class 10 in

Standard ACLs → close to destination. Extended ACLs → close to source. Implicit deny-all at the end. Test connectivity after applying, not just after writing.

4. Verification — run before calling a device "done"#

shell

show running-config
show ip interface brief
show vlan brief
show interfaces <id> switchport
show port-security interface <id>
show access-lists
show ip ssh
show ip route
ping <target>          # both directions

5. Common Self-Inflicted Mistakes to Check#

Wrong IP/subnet mask/gateway (check show ip interface brief first — before chasing anything advanced).
VLAN misassignment / trunk mode-encapsulation mismatch.
A port shutdown that shouldn't be (or vice versa) — link light can look fine while hosts still can't talk.
DHCP pool gateway/DNS typo — a single wrong octet is a classic scoring trap.
ACL blocking traffic you didn't mean to block.

6. Quick Reference — Ports / OSI#

Port	Service	Layer	Name
22	SSH	7	Application
23	Telnet (disable)	4	Transport
53	DNS	3	Network
80/443	HTTP/HTTPS	2	Data Link
161	SNMP	1	Physical

7. Final Pass#

show running-config reviewed end to end on every device. copy run start on every device. Final save-as of the .pkt file.