Question
What are the basic router configuration steps that are similar to switch configuration?
Answer
The initial "housekeeping" tasks — name the device, lock down management access (passwords, banner), and save — are identical on a router and a switch because both run Cisco IOS.
A router and a Layer 2 switch share the same IOS command-line, so when you first bring up either one you perform the same set of foundational tasks before doing anything device-specific (interfaces on a router, VLANs on a switch). Knowing this means the security baseline you already learned on switches transfers directly to routers.
| Step | Command | Why it matters |
|---|---|---|
| 1. Configure device name | hostname name |
Makes the prompt identify the device, avoiding mistakes when several are open |
| 2. Secure privileged EXEC | enable secret password |
Protects the powerful privileged mode; secret is hashed, unlike enable password |
| 3. Secure user EXEC | line console 0 → password pwd → login |
Stops walk-up console access |
| 4. Secure remote access | line vty 0 4 → password pwd → login → transport input ssh telnet |
Protects the virtual terminal lines used for Telnet/SSH |
| 5. Encrypt passwords | service password-encryption |
Hides remaining plaintext passwords in the config file |
| 6. Legal notification | banner motd #message# |
Displays a legal warning to anyone connecting |
| 7. Save configuration | copy running-config startup-config |
Copies the live (RAM) config to NVRAM so it survives a reboot |
Key insight: These steps secure management access and are device-agnostic. What differs is what comes next — on a router you then configure routed interfaces (each needs no shutdown and its own IP), which a Layer 2 switch does not have.
Go deeper:
Jeremy's IT Lab — SSH (CCNA Day 42) — the same management-security baseline (hostname, enable secret, console/VTY, encryption) that applies to routers and switches alike.
Cisco IOS (Wikipedia) — the shared IOS command-line that makes these housekeeping steps identical across device types.
Note saved — thanks!
Question
Walk through a complete worked example: every command, in order, to bring a new router named R1 to a secure baseline.
Answer
From a fresh router: enable → configure terminal, then hostname, enable secret, secure the console and VTY lines, service password-encryption, a banner motd, and finally copy run start to persist it.
This is the concrete transcript for the conceptual steps — note the mode changes in the prompt ((config) → (config-line) → back), which trip people up. You enter line-configuration mode for console and VTY, then exit back to global config for the remaining commands. The example assumes a brand-new R1 you have just connected to via the console.
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# enable secret class
R1(config)# line console 0
R1(config-line)# password cisco
R1(config-line)# login
R1(config-line)# line vty 0 4
R1(config-line)# password cisco
R1(config-line)# login
R1(config-line)# transport input ssh telnet
R1(config-line)# exit
R1(config)# service password-encryption
R1(config)# banner motd #
*******************************************
WARNING: Unauthorized access is prohibited!
*******************************************
#
R1(config)# exit
R1# copy running-config startup-config
Gotcha: The banner delimiter (# here) must be a character that does not appear in the message text, and it must bracket the message on both ends. Forgetting the closing delimiter leaves you stuck typing into the banner. Also remember the order is not arbitrary for security: enable secret before you risk leaving privileged mode unprotected, and copy run start (or wr) last so everything you just did survives a power cycle.
Go deeper:
- Jeremy's IT Lab — SSH (CCNA Day 42) — types the secure-baseline transcript live, including the mode changes that trip people up.
- Cisco IOS — command modes (Wikipedia) — the
(config)→(config-line)→ back transitions shown in the transcript.
Note saved — thanks!