OPERATOR REFERENCE · CISCO IOS / IOS-XE

Cisco IOS / IOS-XE Field Reference
CBS350 · Catalyst 1000 · Catalyst 9300 · ISR Routers

access → modes → VLANs/trunks → interfaces → routing → STP → ACLs/security → stacking → save/backup → troubleshoot

Accuracy note: port counts, memory, and performance figures below are pulled from Cisco's published data sheets for representative SKUs of each family (exact numbers vary by sub-model). CLI syntax targets current IOS-XE for Catalyst 9300 and ISR routers; the CBS350 and Catalyst 1000 run a lighter Cisco Business/switch NOS that is IOS-like but not full IOS-XE — some commands and defaults differ. Items marked VERIFY are worth confirming with show version / the datasheet for your exact SKU before relying on them in production.

ACCESS · Console / SSH

configure terminal

IOS CLI · running-config

write mem

STARTUP · startup-config / TFTP

01 Device Comparison

Model	CPU / Memory	Ports	PoE	Stacking	Best For
CBS350-48P-4X (Business 350)	800 MHz ARM · 256 MB DRAM / 256 MB Flash	48× Gigabit copper + 4× 10G SFP+ uplinks	Up to 370W (P) or 740W (FP) budget across the 48 ports	Up to 4 units, via any 10G SFP+ port (not StackWise)	SMB wiring closet — L2 + basic static-route L3, easy web UI or CLI
C1000-48P-4G-L (Catalyst 1000)	— (VERIFY)	48× Gigabit copper + 4× 1G SFP uplinks (4×10G SFP+ on -4X-L variants)	370W (P) or 740W (FP) budget	None — standalone only, no stacking	SMB/branch replacing older 2960-L gear; simpler than CBS350 to license, no stacking need
C9300-48P (Catalyst 9300)	x86 multi-core · 8 GB DRAM / 16 GB Flash	48× Gigabit copper + modular uplink bay (1G/10G/25G/40G options)	PoE+/UPOE/UPOE+ depending on PSU and SKU (up to ~90W/port on UPOE+)	StackWise-480 (fixed-uplink) or StackWise-1T (modular C9300X), up to 8 units	Enterprise access layer, SD-Access fabric, full dynamic routing (OSPF/EIGRP/BGP)
ISR 4331 (4000 Series ISR)	4-core (2 data-plane + 1 control + 1 services) · 4 GB DRAM / 4 GB Flash (VERIFY exact defaults for your unit)	3× onboard GE (WAN/LAN configurable) + 2× NIM slots + 1× SM slot	Optional via PoE NIM module — not onboard	N/A (router, not stacked)	Branch-office WAN router, up to ~100–300 Mbps aggregate throughput
ISR1100-4G (1000 Series ISR)	x86, ~2.2 GHz · 4 GB DRAM / 16 GB eMMC	4× GE ports, individually configurable as WAN or LAN, + USB 3.0	Not standard onboard	N/A	Compact modern branch router — IOS-XE or Cisco SD-WAN (Viptela) mode

CBS350 and Catalyst 1000 are both fanless, fixed-configuration SMB switches. The Catalyst 9300 is the step up to full enterprise IOS-XE features (SD-Access, StackWise, modular uplinks, dynamic routing) — that jump is the main decision point between the three switch families.

02 Switch Port Maps

CBS350-48P-4X

SMB

48× GbE PoE+ (Gi1/0/1–48) · 4× 10G SFP+ (Gi1/0/49–52, stacking-capable)

1–12

13–24

25–36

37–48

SFP+49

SFP+50

SFP+51

SFP+52

Any of the four 10G SFP+ ports can be dedicated to stacking instead of uplink use — the switch decides based on how you configure the stack, not a fixed port.

Gigabit copper (PoE+)

10G SFP+ uplink/stack

C1000-48P-4G-L

SMB

48× GbE PoE+ (Gi1/0/1–48) · 4× 1G SFP uplinks (Gi1/0/49–52)

1–12

13–24

25–36

37–48

SFP49

SFP50

SFP51

SFP52

No stack ports — each C1000 is managed and configured as a fully standalone switch, even in a multi-switch closet.

Gigabit copper (PoE+)

1G SFP uplink

C9300-48P

Enterprise

48× GbE PoE+ (Gi1/0/1–48) · modular uplink bay (Gi1/1/1–4 or Te/Twe depending on module)

1–12

13–24

25–36

37–48

UL 1

UL 2

UL 3

UL 4

Two dedicated StackWise-480/1T ports sit on the rear panel (not shown) — separate from the front-panel data/uplink ports entirely.

Gigabit copper (PoE+)

Modular uplink (1G/10G/25G/40G)

03 Router Port Layout (ISR)

ISR 4331

3× onboard Gigabit Ethernet — each individually configurable as WAN or LAN
2× Network Interface Module (NIM) slots — WAN modules (T1/E1, serial, xDSL, switch NIMs)
1× Service Module (SM) slot — larger modules (voice, extra switch ports, security)
1× USB console + 1× RJ45 console

VERIFY — exact throughput tier (100 Mbps vs 300 Mbps) depends on the installed performance license, not just hardware.

ISR1100-4G

4× Gigabit Ethernet — each port individually assignable as WAN or LAN in software
USB 3.0 port, RJ45 console
Desktop form factor, no NIM/SM expansion slots (fixed config)

Ships in two operating modes: traditional IOS-XE (autonomous), or Cisco SD-WAN (Viptela) controller-managed — the CLI and config model differ significantly between the two.

04 Access & CLI Modes

◎

Ways In

Console — RJ45 or USB, 9600 8N1 (default) on most models
SSH — needs a hostname, domain, and RSA key generated first
Web UI — primary day-to-day interface on CBS350/C1000; secondary on 9300/ISR

▤

CLI Mode Ladder

Switch> (user EXEC) Switch> enable Switch# (privileged EXEC) Switch# configure terminal Switch(config)# (global config) Switch(config)# interface gi1/0/1 Switch(config-if)# (interface config)

🔑

First-Boot Setup

Switch(config)# hostname sw-access-01 Switch(config)# enable secret StrongPass123! Switch(config)# username netops secret StrongPass123! privilege 15

⚠ never leave "enable password" (unencrypted) or a blank enable secret reachable from any untrusted VLAN

🔐

Enable SSH

Switch(config)# ip domain-name lab.local Switch(config)# crypto key generate rsa modulus 2048 Switch(config)# line vty 0 15 Switch(config-line)# transport input ssh Switch(config-line)# login local

⇥

Shortcuts

Tab — complete a command; ? — list valid next keywords
do — run an EXEC-mode command from inside config mode
no prefix — negates/removes almost any config line
Ctrl+Z — return straight to privileged EXEC from any config depth

🛈

Business-NOS vs IOS-XE

VERIFY — on CBS350/C1000, some familiar IOS verbs are shortened or web-UI-only (e.g. certain QoS/ACL depth). Confirm a given command exists via ? before scripting it, rather than assuming full IOS-XE parity.

05 VLANs & Trunking

◈

Create VLANs

Switch(config)# vlan 20 Switch(config-vlan)# name USERS Switch(config)# vlan 30 Switch(config-vlan)# name VOICE

▣

Access Port

Switch(config)# interface gi1/0/5 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 20 Switch(config-if)# switchport voice vlan 30

⑂

Trunk Port

Switch(config)# interface gi1/0/49 Switch(config-if)# switchport mode trunk Switch(config-if)# switchport trunk allowed vlan 10,20,30 Switch(config-if)# switchport trunk native vlan 999

Move the native VLAN off VLAN 1 to a dedicated unused ID — reduces VLAN-hopping exposure.

⚙

Interface Range

Switch(config)# interface range gi1/0/1-24 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 20

🔍

Verify

Switch# show vlan brief Switch# show interfaces trunk Switch# show interfaces switchport

◑

SVI (routed VLAN interface)

Switch(config)# interface vlan20 Switch(config-if)# ip address 10.0.20.1 255.255.255.0 Switch(config)# ip routing

VERIFY — CBS350/C1000 support SVIs and static routing, but full multi-VRF/dynamic-routing SVI behavior is a Catalyst 9300 (full IOS-XE) capability.

06 Interface & PoE Configuration

✎

Speed / Duplex

Switch(config-if)# speed auto Switch(config-if)# duplex full Switch(config-if)# description Link-to-AP-3F

⚡

PoE Control

Switch(config-if)# power inline auto Switch(config-if)# power inline never Switch# show power inline

Check show power inline total budget vs. allocated before adding more PoE devices — a fully-loaded 48-port PoE+ switch can exceed a lower PSU's wattage.

⇪

EtherChannel / LACP

Switch(config)# interface range gi1/0/47-48 Switch(config-if-range)# channel-group 1 mode active Switch(config)# interface port-channel1 Switch(config-if)# switchport mode trunk

📄

Status

Switch# show interfaces status Switch# show interfaces gi1/0/5

🔌

Errdisable Recovery

Switch(config)# errdisable recovery cause bpduguard Switch(config)# errdisable recovery interval 300

A port stuck in err-disabled (usually from BPDU guard, port security, or a loop) needs either this auto-recovery or a manual shutdown / no shutdown.

🔍

Neighbor Discovery

Switch# show cdp neighbors detail Switch# show lldp neighbors detail

07 Routing

→

Static Route

Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1 Router(config)# ip route 10.10.0.0 255.255.0.0 10.0.0.254 Router# show ip route

≡

OSPF (single area)

Router(config)# router ospf 1 Router(config-router)# network 10.0.0.0 0.0.0.255 area 0 Router(config-router)# passive-interface gi0/0/0

Available on Catalyst 9300 and ISR routers (full IOS-XE). CBS350/C1000 do not run dynamic routing protocols — static routes only.

≡

EIGRP

Router(config)# router eigrp 100 Router(config-router)# network 10.0.0.0 0.0.0.255 Router(config-router)# no auto-summary

≡

BGP (eBGP quick start)

Router(config)# router bgp 65001 Router(config-router)# neighbor 203.0.113.1 remote-as 65000 Router(config-router)# network 198.51.100.0 mask 255.255.255.0

⇋

HSRP (gateway redundancy)

Switch(config-if)# standby 1 ip 10.0.20.1 Switch(config-if)# standby 1 priority 110 Switch(config-if)# standby 1 preempt

Runs on SVIs of a Layer-3 switch (Catalyst 9300) or router sub-interfaces — pairs two devices behind one virtual gateway IP.

🔎

Verify

Router# show ip protocols Router# show ip ospf neighbor Router# show ip bgp summary

08 Spanning Tree

🌳

Mode & Priority

Switch(config)# spanning-tree mode rapid-pvst Switch(config)# spanning-tree vlan 20 priority 4096

Lower priority wins root election. Set the intended core/distribution switch's priority deliberately rather than relying on the default tiebreak (lowest MAC).

🛡

Edge Port Protection

Switch(config-if)# spanning-tree portfast Switch(config-if)# spanning-tree bpduguard enable

⚠ only enable portfast on true end-host ports — enabling it on a port that later gets a switch/hub plugged in risks a bridging loop

🔍

Verify

Switch# show spanning-tree Switch# show spanning-tree vlan 20 Switch# show spanning-tree summary

09 ACLs & Port Security

📋

Standard ACL

Router(config)# ip access-list standard MGMT-ONLY Router(config-std-nacl)# permit 10.0.0.0 0.0.0.255 Router(config)# line vty 0 15 Router(config-line)# access-class MGMT-ONLY in

📋

Extended ACL

Router(config)# ip access-list extended BLOCK-TELNET Router(config-ext-nacl)# deny tcp any any eq 23 Router(config-ext-nacl)# permit ip any any Router(config)# interface gi0/0/1 Router(config-if)# ip access-group BLOCK-TELNET in

🔒

Port Security

Switch(config-if)# switchport port-security Switch(config-if)# switchport port-security maximum 2 Switch(config-if)# switchport port-security violation restrict Switch(config-if)# switchport port-security mac-address sticky

🛡

DHCP Snooping

Switch(config)# ip dhcp snooping Switch(config)# ip dhcp snooping vlan 20 Switch(config-if)# ip dhcp snooping trust

Trust only the uplink/DHCP-server-facing port — every access port stays untrusted by default, which is the point (blocks rogue DHCP servers).

🛡

Dynamic ARP Inspection

Switch(config)# ip arp inspection vlan 20 Switch(config-if)# ip arp inspection trust

Requires DHCP snooping running first — DAI validates ARP replies against the snooping binding table.

🔎

Verify

Switch# show access-lists Switch# show port-security interface gi1/0/5 Switch# show ip dhcp snooping binding

10 Stacking & High Availability

⛓

Catalyst 9300 — StackWise

Switch# show switch Switch(config)# switch 2 priority 15

Highest priority becomes stack master. Dedicated rear-panel stack cables carry both data and control-plane traffic — front-panel ports are unaffected.

⛓

CBS350 Stacking

Configured through the web UI or CLI stack menu, using any of the four 10G SFP+ ports as the stack link — up to 4 units act as one managed switch with one management IP.

VERIFY — exact CLI stack commands differ from StackWise syntax; confirm against the CBS350 admin guide for your firmware version.

Catalyst 1000 — No Stacking

Each C1000 is managed individually. If you need unified multi-switch management in that product tier, that's the CBS350's differentiator — plan the closet accordingly before purchasing.

11 Backup, Save & Upgrade

💾

Save Running Config

Switch# copy running-config startup-config Switch# write memory

⚠ config changes are NOT persistent across reload until one of these is run

📤

Export / Backup Off-Box

Switch# copy running-config tftp://10.0.0.5/sw-backup.cfg Switch# copy startup-config tftp://10.0.0.5/sw-backup.cfg

↺

Restore

Switch# copy tftp://10.0.0.5/sw-backup.cfg startup-config Switch# reload

Restoring to startup-config only takes effect after a reload (or copy ... running-config to merge live, which can behave unexpectedly with conflicting lines).

⇪

IOS Image Upgrade

Switch# copy tftp://10.0.0.5/cat9k_iosxe.bin flash: Switch(config)# boot system flash:cat9k_iosxe.bin Switch# reload

🗂

Archive / Config Rollback

Router(config)# archive Router(config-archive)# path flash:archive-cfg Router# configure replace flash:archive-cfg-3 force

IOS-XE devices (9300, ISR) — configure replace lets you roll the running config back to a known-good archived snapshot in one shot.

🛟

Password Recovery

Interrupt boot at power-on (Break/Ctrl+Break on console) into ROMMON, set the config-register to skip loading startup-config, reload, then rename/reload the saved config and reset the register back.

VERIFY — exact key sequence and ROMMON commands vary by platform (ISR vs Catalyst) and console software.

12 Monitoring & Troubleshooting

📶

Basic Reachability

Router# ping 8.8.8.8 Router# traceroute 8.8.8.8

📄

Logging

Switch# show logging Switch(config)# logging host 10.0.0.5 Switch(config)# logging trap informational

🩺

Debug (careful)

Router# debug ip ospf adj Router# undebug all

⚠ debug output can overwhelm a low-end CPU (esp. CBS350/C1000) — never leave a debug running unattended, use undebug all when done

📊

Resource Health

Router# show processes cpu sorted Router# show memory statistics Switch# show environment

🔗

MAC / ARP Tables

Switch# show mac address-table Router# show arp

First stop when a host can't reach its gateway — confirm the MAC is even showing up on the expected port/VLAN.

🔍

Show Run Filters

Switch# show running-config | section interface Gi1/0/5 Switch# show running-config | include vlan

13 Common Errors & Fixes

Symptom	Likely Cause / Fix
Port stuck in err-disabled	check show interfaces status err-disabled cause; shutdown / no shutdown or errdisable recovery
Trunk passes no traffic for a VLAN	VLAN missing from switchport trunk allowed vlan list, or not created with vlan <id>
Config lost after reload	forgot copy running-config startup-config / write memory before reload
OSPF/EIGRP neighbor won't form	mismatched area/AS, hello/dead timers, or an ACL/firewall blocking the routing protocol
PoE device won't power up	check show power inline — PoE budget exhausted, or power inline never set on that port
Locked out after ACL/line vty change	console in, remove/adjust access-class, or restore last saved config

Command / Action	Risk
write erase / erase startup-config	destructive wipes saved config; still live until reload
configure replace ... force	caution overwrites running config immediately with the archived file
spanning-tree portfast on a non-edge port	destructive risks a forwarding loop if that port later connects another switch
no shutdown on an unverified interface	caution can bridge two VLANs/segments unexpectedly if cabling is wrong
debug all / debug ip packet	destructive can peg CPU and drop the management session on lower-end switches
copy running-config startup-config	safe standard save — no destructive side effects