Articles & Guides
Practical Cisco configuration guides for network engineers: the theory behind each feature, the exact commands, how to verify it worked, and what to check when it doesn't. Written by Khan Mehfooz.
How to Configure SSH on Cisco IOS (Step by Step)
Configure SSH version 2 on a Cisco switch or router: hostname, domain name, RSA keys, local users, VTY lines, ACL protection and verification.
Device Access & AAAHow to Configure Telnet on Cisco IOS (and Why to Move to SSH)
Configure Telnet on Cisco IOS VTY lines for lab or legacy use, see why it is insecure, and learn how to restrict it or move the device to SSH only.
SwitchingHow to Configure EtherChannel on Cisco Switches (LACP, PAgP and Static)
Bundle physical links into one logical EtherChannel with LACP, PAgP or static mode, pick a load-balancing method, then verify and troubleshoot the bundle.
IOS UpgradesHow to Upgrade Cisco Catalyst 2960 IOS Using TFTP and archive download-sw
Upgrade IOS on a Catalyst 2960 or 2960-X: check flash, copy the image over TFTP, set the boot variable, reload and verify, with a rollback plan.
IOS UpgradesHow to Upgrade a Cisco Catalyst 3850 (IOS-XE) in Install Mode
Upgrade a Catalyst 3850 running IOS-XE: check install versus bundle mode, copy the image, install and activate it, clean old packages and verify.
SwitchingHow to Configure VLANs and 802.1Q Trunks on Cisco Switches
Create VLANs, assign access ports, build 802.1Q trunks, set the native VLAN and allowed list, then verify the result with show commands.
SwitchingHow to Configure Spanning Tree on Cisco Switches (Rapid PVST+, PortFast, BPDU Guard)
Configure Rapid PVST+, place the root bridge, enable PortFast and BPDU Guard, and verify port roles and states on Cisco Catalyst switches.
OperationsInitial Configuration of a New Cisco Switch: A Day-0 Checklist
A day-0 baseline for a new Cisco switch: hostname, secrets, SSH, management VLAN, banner, time, logging and saving the configuration.
Switch SecurityHow to Configure Port Security on Cisco Switches
Limit which devices can use an access port: maximum MACs, sticky learning, violation modes, errdisable recovery and verification commands.
Routing & ServicesHow to Configure Inter-VLAN Routing on Cisco (Router-on-a-Stick and SVIs)
Route between VLANs with router-on-a-stick subinterfaces or Layer 3 switch SVIs, with full configuration, verification and troubleshooting.
Device Access & AAAHow to Configure AAA on Cisco IOS (Local, TACACS+ and RADIUS)
Configure AAA authentication, authorization and accounting on Cisco IOS with a local fallback, TACACS+ or RADIUS servers, and verify the result.
OperationsHow to Back Up and Restore Cisco Configurations (TFTP, SCP, archive and Rollback)
Back up and restore Cisco IOS configurations with TFTP, SCP and FTP, schedule archives, and use configure replace for a safe rollback.
Switch SecurityHow to Configure DHCP Snooping and Dynamic ARP Inspection on Cisco Switches
Configure DHCP snooping and Dynamic ARP Inspection with trusted ports, rate limits and verification, and avoid the mistakes that cause outages.
IOS UpgradesHow to Upgrade Cisco Catalyst 9200 and 9300 Switches (IOS-XE Install Mode)
Upgrade Catalyst 9200 and 9300 switches in install mode: prepare flash, install add, activate, commit, verify and roll back if needed.
OperationsHow to Configure NTP on Cisco IOS (Client, Authentication and Server)
Configure NTP on Cisco IOS: servers, authentication, time zone, daylight saving, a local NTP master, and verification of synchronization.
OperationsHow to Configure Syslog and Logging on Cisco IOS
Configure Cisco IOS logging: local buffer, remote syslog server, severity levels, timestamps and tuning noisy messages.
OperationsHow to Configure SNMPv3 on Cisco IOS (Groups, Users and Traps)
Configure SNMPv3 on Cisco IOS with groups, views, users, authentication and encryption, plus traps and verification.
Device Access & AAACisco Password Recovery: Catalyst 2960 Switch and ISR Router Procedures
Recover access to a Cisco Catalyst 2960 switch or router you own using the documented console procedures, and learn how to protect against misuse.
Routing & ServicesHow to Configure Standard and Extended Access Lists on Cisco
Configure standard, extended and named ACLs on Cisco IOS with correct wildcard masks, placement and verification, plus common mistakes.
Routing & ServicesHow to Configure Single-Area OSPF on Cisco Routers
Configure single-area OSPFv2 on Cisco routers: router IDs, network statements, passive interfaces, cost and verification of neighbors and routes.
Routing & ServicesHow to Configure Static Routes and Default Routes on Cisco
Configure static, default and floating static routes on Cisco IOS, understand next-hop versus exit interface, and verify the routing table.
Routing & ServicesHow to Configure a DHCP Server and DHCP Relay on Cisco Devices
Configure a DHCP server on a Cisco router or Layer 3 switch with pools and exclusions, and relay requests with ip helper-address.
Routing & ServicesHow to Configure NAT and PAT on a Cisco Router
Configure static NAT, dynamic NAT and PAT overload on a Cisco router, with the inside/outside model explained and translations verified.
Routing & ServicesHow to Configure EIGRP on Cisco Routers
Configure EIGRP on Cisco routers with classic and named mode, understand DUAL and metrics, and verify neighbors, topology and routes.
IOS UpgradesHow to Upgrade the IOS or IOS-XE Image on a Cisco ISR Router
Upgrade the image on a Cisco ISR router: check flash, copy the file, set the boot statement, reload, verify and roll back.
SwitchingHow to Configure a Cisco Switch Stack (Roles, Priority and Renumbering)
Understand and configure a Cisco switch stack: active and standby roles, priority, member renumbering, verification and troubleshooting.
SwitchingHow to Configure VTP on Cisco Switches (and Avoid the Revision-Number Trap)
Configure VTP server, client, transparent and off modes, understand versions 1, 2 and 3, and avoid the revision-number problem.
SwitchingHow to Configure CDP and LLDP on Cisco Devices
Configure CDP and LLDP on Cisco devices, read neighbor tables, and limit discovery protocols where they should not run.
SwitchingHow to Configure a Voice VLAN and PoE on a Cisco Switch
Configure a voice VLAN, QoS trust and Power over Ethernet on a Cisco access switch for IP phones, and verify the results.
OperationsHow to Configure SPAN Port Mirroring on Cisco Switches (SPAN and RSPAN)
Configure local SPAN and RSPAN on Cisco switches to copy traffic to a monitoring port, with limits, verification and common pitfalls.
Password SecurityMigrating from Cisco Type 7 to Type 9: A Practical Guide
A complete, phased guide to auditing which Cisco devices still use Type 7 password encryption and migrating them to Type 9 (scrypt) without breaking access.
Password SecurityEncoding vs. Encryption vs. Hashing: What Network Engineers Actually Need to Know
A practical, non-academic explanation of the difference between encoding, encryption, and hashing, and why Cisco Type 7 is neither secure encryption nor a hash.
Password SecurityCisco IOS Password Security: A Working Checklist
A complete field checklist for auditing Cisco IOS password security: enable secrets, AAA, local accounts, line passwords, SNMP, and a quarterly review cadence.
Password SecurityAuditing Legacy Network Configs When You Inherit a Network
A practical approach to auditing an inherited network's configs: what to check first, how to prioritize remediation, and how to avoid breaking things along the way.
Free Tools
Alongside the guides there are two free browser-based tools: the Cisco Type 7 password decoder (batch input with a step-by-step breakdown) and an IPv4 subnet calculator for quick CIDR, mask and host-range lookups.