How to Configure Cisco Router and Switch Step by Step for Beginners

 Almost every beginner's first Cisco session ends the same way: a few commands typed, everything appears to work, the device is powered off, and the entire configuration vanishes.

The cause is one command that nobody told them about. Cisco devices keep two separate configuration files, and typing a command only edits the temporary one. This single detail catches more newcomers than any complex topic ever will.

This guide walks through how to configure Cisco router and switch devices from a blank state, in the order a working engineer actually does it, and explains what each command is doing rather than asking you to copy it blindly.

The Two Configuration Files You Must Understand First

Before any command, understand this:

• running-config — lives in RAM, holds the active configuration, and disappears completely when power is lost.
• startup-config — lives in NVRAM, and is what the device loads when it boots.

Every command you type edits running-config only. Until you copy it to startup-config, your work is temporary.

The command that saves it:

copy running-config startup-config

Or the shorter form experienced engineers use:

wr

Make this a reflex. Configure, verify, save. Many engineers save after every meaningful block of changes rather than at the end of a session.

Cisco IOS Command Modes

Cisco IOS command modes are hierarchical, and each mode accepts a different set of commands. Beginners waste a lot of time typing correct commands in the wrong mode.

The four modes you will use constantly:

1. User EXEC mode — prompt ends with >. Very limited. You can look at a few things and little else.
2. Privileged EXEC mode — prompt ends with #. Full visibility, all show commands, and the ability to save and reload.
3. Global configuration mode — prompt shows (config)#. This is where you change device-wide settings.
4. Specific configuration modes — prompt shows (config-if)#, (config-line)#, (config-vlan)# and similar. These configure one interface, one line, or one VLAN.

Moving between them:

enable
configure terminal
interface gigabitEthernet 0/1

Moving back:

• exit drops you one level.
• end returns you straight to privileged EXEC from anywhere.
• Ctrl+Z does the same as end.

A time-saving habit: IOS accepts abbreviations as long as they are unambiguous. conf t works for configure terminal, int gi0/1 for the interface command, and sh run for show running-config.

Connecting to the Device for the First Time

A brand new device has no IP address, so you cannot connect over the network. Console access is the only way in.

What you need:

1. A console cable — either the classic blue rollover cable with a serial end, or a USB console cable on modern devices.
2. Terminal software on your computer.
3. The correct serial settings, which have been standard for decades: 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.

Connect, open the session, and press Enter. You should see a prompt. If the device is genuinely unconfigured it may ask whether you want to enter the initial setup dialog — answer no. That wizard produces a configuration you will not understand and will have to undo.

Basic Switch Configuration Step by Step

Here is the sequence for a switch coming out of the box.

Step 1: Enter configuration mode and name the device

enable
configure terminal
hostname SW1

Naming matters more than it seems. When you are logged into four devices at once, the hostname in the prompt is what stops you configuring the wrong one.

Step 2: Secure privileged EXEC access

enable secret MyStrongPassword

Use enable secret, never enable password. The first is hashed. The second is stored in a form that is trivially reversible. If both exist, enable secret wins.

Step 3: Secure console and remote access

line console 0
 password ConsolePass
 login
 exit
line vty 0 15
 password VtyPass
 login
 exit

The vty lines control remote sessions. Without a password configured on them, most IOS versions refuse remote logins entirely.

Step 4: Encrypt the plain-text passwords

service password-encryption

Be honest about what this does. It applies weak, reversible encryption. It stops someone reading a password over your shoulder. It does not protect against a determined attacker who obtains the configuration file.

Step 5: Give the switch a management IP address

A switch does not need an IP address to forward frames. It needs one so you can reach it remotely.

interface vlan 1
 ip address 192.168.1.10 255.255.255.0
 no shutdown
 exit
ip default-gateway 192.168.1.1

That last line surprises people. A Layer 2 switch has no routing table. The ip default-gateway command exists specifically to tell it where to send its own management traffic when the destination is on another network.

Step 6: Add a login banner

banner motd #Authorized access only.#

This is a legal measure, not a technical one, and it is standard practice in professional environments.

Step 7: Save

end
copy running-config startup-config

Basic Router Configuration Step by Step

A router follows the same opening steps — hostname, enable secret, console and vty security — then diverges at the interfaces.

Step 1: Configure an interface

configure terminal
interface gigabitEthernet 0/0
 description LAN-side
 ip address 192.168.1.1 255.255.255.0
 no shutdown
 exit

Two details to note:

1. no shutdown is mandatory. Router interfaces are administratively down by default. Forgetting this command is the single most common beginner error on routers.
2. Unlike a switch, a router interface genuinely needs an IP address. That address becomes the default gateway for every device on that network segment.

Step 2: Configure the second interface

interface gigabitEthernet 0/1
 description WAN-side
 ip address 10.0.0.1 255.255.255.252
 no shutdown
 exit

A router with one interface is not doing anything useful. Routing means moving traffic between at least two networks.

Step 3: Add a static route

ip route 0.0.0.0 0.0.0.0 10.0.0.2

This is the default route, and it reads as: "for any destination I do not have a specific entry for, send it to 10.0.0.2." On most edge routers, that next hop is the provider's equipment.

Step 4: Enable DHCP for the local network

ip dhcp excluded-address 192.168.1.1 192.168.1.20
ip dhcp pool LAN-POOL
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 8.8.8.8
 exit

Exclude your static addresses first. The exclusion command comes before the pool for a reason: it prevents the router handing out addresses you have already assigned manually to servers, printers, or the router itself.

Step 5: Save

end
wr

Verification Commands You Should Run Every Time

Configuring is half the job. Verifying is the half that separates a professional from someone who types commands hopefully.

On both devices:

• show running-config — the full active configuration.
• show version — model, IOS version, uptime, and the configuration register value.
• show ip interface brief — the fastest overview of every interface, its IP, and its status.

On a switch specifically:

• show mac address-table — which MAC addresses the switch has learned and on which ports.
• show vlan brief — VLANs and their assigned ports.
• show interfaces status — port speed, duplex, and connection state.

On a router specifically:

• show ip route — the routing table.
• show ip protocols — active routing protocols.

Reading show ip interface brief correctly is a core skill. Two columns matter:

• Status refers to the physical layer. up means a cable is connected and carrying signal.
• Protocol refers to the data link layer. up means the interface is fully operational.

The common failure patterns:

• administratively down / down — you forgot no shutdown.
• down / down — cable problem, wrong cable type, or the other end is off.
• up / down — physical link exists but there is a mismatch, often an encapsulation or clocking issue on serial links.

Mistakes That Cost Beginners Hours

1. Forgetting to save, and losing everything on reload.
2. Forgetting no shutdown on router interfaces.
3. Typing commands in the wrong mode and assuming the device is faulty.
4. Using enable password instead of enable secret.
5. Assigning an IP to a switch port rather than to the VLAN interface. Layer 2 switch ports do not take IP addresses.
6. Omitting ip default-gateway on a switch, then wondering why it is unreachable from another subnet.
7. Configuring over an in-band connection and cutting off your own access mid-change.
8. Never running a show command to confirm the result.

A Safe Habit Worth Adopting Early

Before making changes on a device that matters:

1. Capture the current configuration with show running-config and save the output to a text file.
2. Make your changes in small blocks.
3. Verify after each block with the relevant show command.
4. Save only once you have confirmed the device still behaves correctly.
5. Keep the previous configuration file until you are certain the change is stable.

On production equipment, the reload in 10 command is a genuine lifesaver. It schedules a reboot in ten minutes. If your change locks you out, the device reverts to its saved configuration automatically. If everything works, reload cancel stops it.

Conclusion

Cisco configuration is not difficult; it is unforgiving of small omissions. Three habits cover most of it: know which mode you are in, run a show command after every change, and save before you walk away.

Start with one exercise today: build a single switch in a free network simulator, set a hostname and an enable secret, give VLAN 1 an IP address, and save the configuration. Then reload the device and confirm your settings survived. That one cycle teaches you more about how to configure Cisco router and switch equipment than reading three chapters, because it forces you to meet the running-config and startup-config distinction personally.