Enter privileged EXEC
enableMoves from user EXEC mode to privileged EXEC mode.
Multi-vendor network reference
Choose the vendor, equipment, and experience level, then find the correct syntax, platform family, CLI mode, and safe example for the device in front of you.
Use Advanced to focus on resiliency, policy, segmentation, security, and deep troubleshooting.
All vendors · all equipment · all levels
enableMoves from user EXEC mode to privileged EXEC mode.
configure terminalOpens global configuration mode for device-wide changes.
hostname <NAME>Changes the device name shown in the CLI prompt and configuration.
show running-configDisplays the configuration currently active in memory.
show startup-configDisplays the configuration stored for the next boot.
copy running-config startup-configCopies the active configuration into startup configuration storage.
Save only after validation. This changes the configuration used at the next boot.
show versionShows hardware, software release, uptime, boot image, and configuration register details.
show ip interface briefLists interfaces, IPv4 addresses, administrative state, and line protocol state.
interface <INTERFACE>Selects a physical, logical, or virtual interface for configuration.
description <TEXT>Adds an operational description to the selected interface.
ip address <ADDRESS> <MASK>Configures a primary IPv4 address and subnet mask on a routed interface.
ipv6 address <PREFIX/LENGTH>Configures an IPv6 address and prefix length on an interface.
no shutdownRemoves the administrative shutdown state from the selected interface.
shutdownPlaces the selected interface into an administratively down state.
This can immediately interrupt traffic on the interface.
vlan <VLAN_ID>Creates a VLAN or enters VLAN configuration mode for an existing VLAN.
name <VLAN_NAME>Assigns a readable name to the selected VLAN.
switchport mode accessForces the selected Layer 2 interface to operate as a static access port.
switchport access vlan <VLAN_ID>Places untagged access traffic into the specified VLAN.
switchport mode trunkForces the selected Layer 2 interface to carry tagged VLAN traffic.
switchport trunk allowed vlan <LIST>Defines which VLANs may traverse the selected trunk.
switchport trunk native vlan <VLAN_ID>Selects the VLAN used for untagged frames on an 802.1Q trunk.
The native VLAN must match on both ends of the trunk.
spanning-tree portfastAllows an edge access port to transition to forwarding without the normal STP delay.
Use only on ports that cannot create a Layer 2 loop.
spanning-tree bpduguard enableProtects an edge port by err-disabling it when a BPDU is received.
show vlan briefShows VLAN status, names, and assigned access ports.
show interfaces trunkShows operational trunks, native VLANs, and allowed and forwarding VLANs.
show spanning-tree vlan <VLAN_ID>Displays the root, port roles, costs, and states for a VLAN.
ip routingEnables IPv4 packet forwarding on platforms where routing is not already active.
ip route <NETWORK> <MASK> <NEXT_HOP>Installs a static IPv4 route, including a default route when the prefix is all zeroes.
ipv6 unicast-routingEnables IPv6 packet forwarding on the device.
ipv6 route <PREFIX/LENGTH> <NEXT_HOP>Installs an IPv6 static route or default route.
show ip routeDisplays installed IPv4 routes and the source protocol for each entry.
show ip route <PREFIX>Shows the best route and forwarding details for a specific IPv4 prefix.
router ospf <PROCESS_ID>Creates or enters an OSPFv2 routing process.
router-id <IP_ADDRESS>Sets the stable 32-bit identifier used by the OSPF process.
passive-interface defaultSuppresses OSPF neighbor formation on every interface until explicitly permitted.
no passive-interface <INTERFACE>Allows OSPF hellos and adjacency formation on one interface.
ip ospf <PROCESS_ID> area <AREA>Activates OSPFv2 for the interface and assigns it to an area.
ip ospf network point-to-pointRemoves DR and BDR election behavior on a point-to-point link.
show ip ospf neighborShows OSPF neighbor states, router IDs, dead timers, and interfaces.
router bgp <LOCAL_AS>Creates or enters the BGP routing process for a local autonomous system.
neighbor <PEER_IP> remote-as <REMOTE_AS>Defines a BGP neighbor and its remote autonomous system.
address-family ipv4 unicastEnters the IPv4 unicast address-family configuration context.
network <NETWORK> mask <MASK>Originates a prefix into BGP when an exact route exists in the routing table.
show ip bgp summarySummarizes BGP neighbor state, uptime, message counts, and received prefixes.
enable secret <SECRET>Configures the secret used to enter privileged EXEC mode.
Use an approved secret-management process. Never store real secrets in exported examples.
username <NAME> privilege 15 secret <SECRET>Creates a privileged local account with a protected secret.
Prefer centralized AAA for production access and keep local credentials in a vault.
ip domain name <DOMAIN>Defines the domain suffix used by SSH key generation and name services.
crypto key generate rsa modulus <BITS>Generates an RSA key pair used by the IOS SSH server.
Key-generation options vary by platform and release. Validate the required algorithm and key size.
ip ssh version 2Restricts the IOS SSH server to protocol version 2.
line vty <FIRST> <LAST>Enters configuration mode for the virtual terminal lines.
login localAuthenticates line access against locally configured usernames.
transport input sshPrevents inbound Telnet and permits SSH for remote CLI access.
ip access-list extended <NAME>Creates or enters a named extended IPv4 access list.
deny ip <SOURCE> <WILDCARD> <DESTINATION> <WILDCARD>Blocks matching IPv4 traffic in a named extended ACL.
ACLs are processed top-down and end with an implicit deny.
ip access-group <NAME> {in | out}Applies a named IPv4 access list to an interface direction.
A restrictive ACL can immediately interrupt management or production traffic.
show access-listsDisplays ACL entries and match counters.
ntp server <IP_ADDRESS>Adds a time source for clock synchronization.
logging host <IP_ADDRESS>Forwards system log messages to a remote collector.
ip dhcp excluded-address <LOW> <HIGH>Reserves an IPv4 address range so the local DHCP server will not lease it.
ip dhcp pool <NAME>Creates or enters a local IOS DHCP pool.
network <NETWORK> <MASK>Defines the address network offered by the selected DHCP pool.
default-router <IP_ADDRESS>Supplies one or more default gateways to DHCP clients.
dns-server <IP_ADDRESSES>Supplies DNS resolver addresses to DHCP clients.
ping <DESTINATION>Sends ICMP echo requests to test basic Layer 3 reachability.
traceroute <DESTINATION>Shows the routed hops toward an IPv4 destination.
show cdp neighbors detailShows detailed Cisco Discovery Protocol neighbor information.
show lldp neighbors detailShows detailed vendor-neutral Layer 2 neighbor information.
show interfaces counters errorsSummarizes physical and forwarding error counters on supported switching platforms.
show loggingDisplays logging settings and recent buffered system messages.
configure terminalEnters global configuration mode on an AOS-CX switch.
hostname <NAME>Sets the system hostname on an AOS-CX switch.
vlan <VLAN_ID>Creates a VLAN or enters its configuration context.
interface <PORT>Enters configuration mode for a physical AOS-CX interface.
no routingDisables routed-port behavior so VLAN access or trunk commands can be applied.
vlan access <VLAN_ID>Places an AOS-CX Layer 2 interface into one untagged access VLAN.
vlan trunk native <VLAN_ID>Defines the untagged native VLAN on an AOS-CX trunk.
Include the native VLAN in the allowed list when untagged traffic must traverse the trunk.
vlan trunk allowed <VLAN_LIST>Sets the VLAN IDs permitted across an AOS-CX trunk interface.
interface vlan <VLAN_ID>Creates or enters the switched virtual interface for a VLAN.
ip address <PREFIX/LENGTH>Assigns an IPv4 prefix to a routed interface or SVI.
ip route <PREFIX/LENGTH> <NEXT_HOP>Adds an IPv4 static route to the default VRF.
router ospf <PROCESS_ID>Creates or enters an OSPFv2 routing process.
ip ospf <PROCESS_ID> area <AREA>Activates an OSPF process and area on the selected routed interface.
show interface briefShows interface administrative and operational state.
show vlanLists configured VLANs and their operational state.
write memorySaves the running configuration for the next boot.
Save only after the running configuration has been validated.
vlan <VLAN_ID>Creates or enters a VLAN on legacy ProCurve and ArubaOS-Switch platforms.
name "<VLAN_NAME>"Assigns a readable name inside the selected VLAN context.
untagged <PORT_LIST>Makes the selected ports untagged members of the current VLAN.
tagged <PORT_LIST>Makes the selected ports tagged members of the current VLAN.
show vlansLists VLANs and membership on ArubaOS-Switch platforms.
configureMoves an EdgeRouter from operational mode into configuration mode.
set system host-name <NAME>Stages a new system hostname in the EdgeOS candidate configuration.
set interfaces ethernet <PORT> description <TEXT>Adds a description to an EdgeRouter Ethernet interface.
set interfaces ethernet <PORT> address <PREFIX/LENGTH>Stages an IPv4 or IPv6 prefix on an Ethernet interface.
set interfaces ethernet <PORT> vif <VLAN_ID> address <PREFIX/LENGTH>Creates a tagged virtual interface and assigns its address.
set protocols static route <PREFIX> next-hop <NEXT_HOP>Stages a static route and next hop in EdgeOS.
set protocols ospf parameters router-id <IP_ADDRESS>Sets the stable router identifier for the EdgeOS OSPF process.
set protocols ospf area <AREA> network <PREFIX>Enables OSPF for a network in the selected area.
set protocols bgp <LOCAL_AS> neighbor <PEER_IP> remote-as <REMOTE_AS>Stages an eBGP or iBGP neighbor under the local autonomous system.
compareShows the difference between the candidate and active configurations.
commit-confirm <MINUTES>Applies candidate changes with an automatic reboot safeguard unless confirmed.
Confirm the change before the timer expires or the device will reboot to recover the boot configuration.
confirmCancels the reboot safeguard after a successful commit-confirm validation.
commitActivates the current EdgeOS candidate configuration.
Commit applies changes immediately but does not save them for the next boot.
saveWrites the active EdgeOS configuration to the boot configuration.
show configurationDisplays the active hierarchical EdgeOS configuration.
infoShows adoption and controller information from a supported UniFi device SSH session.
set-inform http://<CONTROLLER>:8080/informDirects an unadopted UniFi device to a reachable UniFi Network application.
UniFi configuration should normally be managed in the controller. Use SSH only for supported adoption or troubleshooting workflows.
configureOpens the candidate configuration hierarchy on a Junos device.
set system host-name <NAME>Stages a new system hostname in the Junos candidate configuration.
set interfaces <PORT> description <TEXT>Adds a description to a Junos interface.
set interfaces <PORT> unit 0 family inet address <PREFIX/LENGTH>Stages an IPv4 address on logical unit 0.
set vlans <NAME> vlan-id <VLAN_ID>Creates a named VLAN and assigns its numeric ID.
set interfaces <PORT> unit 0 family ethernet-switching interface-mode accessStages access mode on a Junos Ethernet switching interface.
set interfaces <PORT> unit 0 family ethernet-switching vlan members <VLAN>Assigns a VLAN to an Ethernet switching interface.
set routing-options static route <PREFIX> next-hop <NEXT_HOP>Stages a static route in the default routing instance.
set protocols ospf area <AREA> interface <INTERFACE>Adds a logical interface to a Junos OSPF area.
set protocols bgp group <GROUP> neighbor <PEER_IP> peer-as <REMOTE_AS>Stages a BGP neighbor inside a named peer group.
show | compareDisplays differences between the candidate and active Junos configurations.
commit checkChecks candidate syntax and consistency without activating the changes.
commit confirmed <MINUTES>Activates changes temporarily and rolls back automatically unless they are confirmed.
Confirm the change with commit before the timer expires.
commitValidates and activates the Junos candidate configuration.
show interfaces terseLists Junos interfaces, administrative state, link state, and protocol addresses.
show routeDisplays active and hidden routes across Junos routing tables.
/system identity set name=<NAME>Sets the device identity shown in RouterOS management tools and the CLI prompt.
/ip address add address=<PREFIX/LENGTH> interface=<INTERFACE>Adds an IPv4 prefix to a RouterOS interface.
/interface bridge add name=<BRIDGE>Creates a software or hardware-offloaded Layer 2 bridge.
/interface bridge port add bridge=<BRIDGE> interface=<PORT>Adds an interface as a member of a RouterOS bridge.
/interface vlan add name=<NAME> vlan-id=<ID> interface=<PARENT>Creates an 802.1Q VLAN interface on a parent interface or bridge.
/ip route add dst-address=<PREFIX> gateway=<NEXT_HOP>Adds an IPv4 static route to the main RouterOS routing table.
/routing ospf instance add name=<NAME> version=2 router-id=<IP>Creates an OSPFv2 instance with a stable router ID.
/routing ospf area add name=<NAME> area-id=<AREA> instance=<INSTANCE>Adds an OSPF area to a RouterOS OSPF instance.
/routing ospf interface-template add networks=<PREFIX> area=<AREA_NAME>Creates an OSPF interface template that matches a network prefix.
/ip firewall filter add chain=input connection-state=established,related action=acceptAdds an input-chain rule for established and related connections.
RouterOS firewall rules are order-sensitive. Review the complete chain before adding a rule.
/export file=<NAME>Writes a text configuration export for review or recovery planning.
Review exported files for sensitive information before moving them off the device.
/interface printLists RouterOS interfaces, flags, names, types, and state.
/ip route printDisplays IPv4 routes, flags, gateways, and administrative distance.
vrf definition <VRF_NAME>Creates a named VRF for an isolated routing table on IOS XE.
address-family ipv4Enters and enables the IPv4 unicast address family inside a VRF definition.
vrf forwarding <VRF_NAME>Moves the selected Layer 3 interface into a named VRF.
Applying VRF forwarding can remove the existing IP address from the interface. Plan and restore addressing in the VRF context.
show ip route vrf <VRF_NAME>Displays IPv4 routes installed in one VRF rather than the global table.
channel-group <NUMBER> mode activeAdds the selected interface to an actively negotiating LACP bundle.
Member ports must use compatible speed, duplex, VLAN, and trunk settings.
interface port-channel <NUMBER>Enters the logical EtherChannel interface used to configure the bundle.
show etherchannel summarySummarizes channel protocols, bundle state, and member-port state flags.
standby <GROUP> ip <VIRTUAL_IP>Assigns the virtual IPv4 gateway used by an HSRP group.
standby <GROUP> priority <VALUE>Changes the preference used to elect the active HSRP router.
standby <GROUP> preemptAllows a higher-priority router to reclaim the active HSRP role.
Use a delay to avoid premature failback while routing protocols and uplinks converge.
standby <GROUP> track <OBJECT> decrement <VALUE>Reduces HSRP priority when a tracked path or object fails.
show standby briefShows HSRP group roles, priorities, peers, and virtual addresses.
ip sla <OPERATION_ID>Creates an active monitoring operation for path-aware failover and measurement.
icmp-echo <DESTINATION> source-interface <INTERFACE>Makes an IP SLA operation test reachability to a destination from a selected interface.
ip sla schedule <ID> life forever start-time nowStarts an IP SLA operation immediately and keeps it active.
track <OBJECT> ip sla <ID> reachabilityCreates a Boolean tracking object from an IP SLA reachability result.
ip prefix-list <NAME> seq <SEQ> permit <PREFIX>Creates an ordered prefix filter for routing policy.
Prefix lists have an implicit deny. Confirm all intended prefixes and length ranges are permitted.
route-map <NAME> permit <SEQ>Creates a routing-policy sequence that can match and modify routes.
match ip address prefix-list <NAME>Matches routes permitted by a named IP prefix list.
neighbor <PEER_IP> route-map <NAME> inApplies a route-map to updates received from one BGP neighbor.
A policy change can withdraw routes. Review the policy and use a route refresh or soft reset deliberately.
ip dhcp snoopingEnables the DHCP snooping feature before it is activated for selected VLANs.
ip dhcp snooping vlan <VLAN_LIST>Activates DHCP message inspection and binding learning on specified VLANs.
ip dhcp snooping trustAllows DHCP server messages to enter through the selected interface.
Trust only paths toward authorized DHCP servers. Trusting an edge port defeats the protection.
ip arp inspection vlan <VLAN_LIST>Validates ARP packets against trusted bindings on selected VLANs.
Ensure valid DHCP snooping bindings or ARP ACLs exist before enabling inspection.
switchport port-securityEnables MAC-address enforcement on the selected static access or trunk port.
switchport port-security mac-address stickyLearns observed source MAC addresses as sticky secure addresses.
Review learned addresses before saving the configuration or moving endpoint hardware.
class-map match-any <NAME>Creates a traffic class whose match statements are evaluated for QoS policy.
match dscp <VALUE>Classifies packets carrying a selected DiffServ code point.
policy-map <NAME>Creates a service policy containing traffic classes and QoS actions.
priority percent <PERCENT>Allocates a strict-priority bandwidth percentage to the selected policy class.
Oversizing priority traffic can starve other classes. Base the value on measured traffic and link capacity.
service-policy output <POLICY_NAME>Attaches a QoS policy to packets leaving the selected interface.
show policy-map interface <INTERFACE>Shows policy attachment, class counters, drops, and queue behavior.
interface lag <NUMBER>Creates or enters a logical link aggregation interface.
lacp mode activeMakes the selected AOS-CX LAG actively negotiate LACP.
lag <NUMBER>Associates the selected physical interface with a logical LAG.
Align VLAN, speed, duplex, and MTU expectations across all member ports and the peer.
show lacp interfacesDisplays LACP actor, partner, state, and aggregation information.
vrf <VRF_NAME>Creates a separate routing instance on an AOS-CX switch.
vrf attach <VRF_NAME>Moves the selected routed interface or SVI into a named VRF.
Move the interface only during an approved change window; routing and management reachability can change immediately.
show ip route vrf <VRF_NAME>Displays IPv4 routes in one AOS-CX VRF.
set firewall name <POLICY> default-action dropCreates or updates an EdgeOS firewall policy with a default drop action.
Build required allow rules before applying a default-deny policy to an interface.
set firewall name <POLICY> rule <ID> action acceptSets an individual EdgeOS firewall rule to accept matching traffic.
set firewall name <POLICY> rule <ID> state established enableMatches packets belonging to established stateful firewall connections.
set interfaces ethernet <PORT> firewall in name <POLICY>Applies a named policy to traffic entering an Ethernet interface.
Use commit-confirm when changing a firewall on the interface that carries your management session.
set service nat rule <ID> type masqueradeSets a source NAT rule to use the outbound interface address.
set service nat rule <ID> outbound-interface <PORT>Limits an EdgeOS NAT rule to traffic leaving one interface.
set service nat rule <ID> source address <PREFIX>Restricts an EdgeOS NAT rule to a selected inside source prefix.
set chassis aggregated-devices ethernet device-count <COUNT>Allocates logical ae interfaces for Ethernet link aggregation.
set interfaces <PORT> ether-options 802.3ad <AE_INTERFACE>Binds a physical Ethernet interface to a Junos aggregated Ethernet interface.
set interfaces <AE_INTERFACE> aggregated-ether-options lacp activeMakes an aggregated Ethernet interface actively negotiate LACP.
set policy-options prefix-list <NAME> <PREFIX>Adds a route prefix to a named Junos policy prefix list.
set policy-options policy-statement <POLICY> term <TERM> from prefix-list <LIST>Matches policy routes against a named prefix list.
set policy-options policy-statement <POLICY> term <TERM> then acceptSets the action for matching routes in a Junos policy term to accept.
set policy-options policy-statement <POLICY> term REJECT then rejectAdds a final Junos policy term that rejects routes not accepted earlier.
Junos policy terms are evaluated in order. Confirm term names and ordering before applying the policy.
set protocols bgp group <GROUP> import <POLICY>Filters or modifies routes received by a Junos BGP group.
Use commit check and commit confirmed; an incorrect import policy can withdraw reachable prefixes.
set routing-instances <VRF> instance-type vrfCreates a Layer 3 VPN routing instance with VRF semantics.
set routing-instances <VRF> interface <INTERFACE.UNIT>Moves a logical interface into a Junos routing instance.
set routing-instances <VRF> route-distinguisher <ASN:VALUE>Assigns a route distinguisher to make VPN routes unique.
set routing-instances <VRF> vrf-target target:<ASN:VALUE>Defines the route target used to import and export Layer 3 VPN routes.
show route table <VRF>.inet.0Displays IPv4 unicast routes in a named Junos routing instance.
show bgp summarySummarizes Junos BGP peer state, uptime, and route counts.
show ospf neighbor detailShows detailed Junos OSPF adjacency state, timers, and interface information.
/routing table add name=<TABLE> fibCreates a named FIB-enabled routing table for policy routing or VRF use.
/ip vrf add name=<VRF> interfaces=<INTERFACE>Creates a VRF and assigns matching interfaces to its routing table.
The order of VRF entries matters, and assigning a management interface can cut off access.
/ip route add dst-address=<PREFIX> gateway=<NEXT_HOP> routing-table=<TABLE>Installs a static route in a selected RouterOS v7 routing table.
/ip route print detail where routing-table=<TABLE>Filters detailed route output to one RouterOS routing table.
/ip firewall nat add chain=srcnat out-interface=<WAN> action=masqueradeTranslates inside source addresses to the active WAN interface address.
/ip firewall filter add chain=input connection-state=invalid action=dropDrops packets classified as invalid by RouterOS connection tracking.
Firewall rules are order-sensitive. Place state rules within a reviewed complete ruleset.
/ip firewall filter add chain=input protocol=tcp dst-port=22 src-address=<MGMT_PREFIX> action=acceptAllows SSH to the router only from a selected management prefix.
Add and test the allow rule before a later blanket input-chain drop rule.
/interface wireguard add name=<NAME> listen-port=<PORT>Creates a WireGuard tunnel interface and local private key in RouterOS.
Protect private keys and restrict the listening port with an appropriate input firewall policy.
/ip address add address=<PREFIX/LENGTH> interface=<WG_INTERFACE>Assigns an IPv4 tunnel prefix to a RouterOS WireGuard interface.
/interface wireguard peers add interface=<WG_INTERFACE> public-key="<PUBLIC_KEY>" allowed-address=<PREFIX>Adds a peer identity and its permitted tunnel addresses to a WireGuard interface.
Each peer allowed-address must be intentional and non-overlapping unless the routing design explicitly requires it.
/tool torch interface=<INTERFACE>Shows real-time traffic rates grouped by addresses, ports, and protocols.
/tool sniffer quick interface=<INTERFACE>Starts an interactive RouterOS packet capture view on one interface.
Packet inspection can expose sensitive traffic and consume resources on busy devices.