Cisco IOS

enable
terminal length 0
show version
show inventory
show running-config | include hostname|ip route|username
show processes cpu sorted | exclude 0.00%
show memory statistics
show logging | begin <Mon DD HH:MM>

interface range GigabitEthernet1/0/23 - 24
 channel-group 1 mode active            ! creates interface Port-channel1
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport nonegotiate

show etherchannel summary
show etherchannel 1 detail | include Protocol|State|Port-channel
show lacp neighbor

interface Vlan20
 ip address 192.0.2.2 255.255.255.0
 standby version 2
 standby 20 ip 192.0.2.1
 standby 20 priority 110
 standby 20 preempt delay minimum 60
 standby 20 track 1 decrement 20
!
track 1 interface GigabitEthernet1/0/1 line-protocol

show standby brief                       ! P = preempt, state Active/Standby, virtual IP
show track brief

interface GigabitEthernet1/0/2
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict
!
errdisable recovery cause psecure-violation
errdisable recovery interval 300

hostname sw-01
ip domain name example.com
crypto key generate rsa modulus 4096
ip ssh version 2
ip ssh server algorithm encryption aes256-gcm aes256-ctr
!
no ip http server
no ip http secure-server                 ! unless RESTCONF or a web GUI is required
no service pad
no ip source-route
service password-encryption
service timestamps log datetime msec localtime show-timezone
!
username admin privilege 15 secret <secret>       ! secret hashes it (type 9 scrypt on current IOS XE); password does not
enable secret <secret>
!
ip access-list standard MGMT-HOSTS
 permit 192.0.2.0 0.0.0.255
!
line vty 0 15
 transport input ssh
 access-class MGMT-HOSTS in
 exec-timeout 10 0
 logging synchronous
!
ntp authentication-key 1 hmac-sha2-256 <key>
ntp authenticate
ntp trusted-key 1
ntp server 192.0.2.123 key 1
clock timezone AEST 10 0
!
logging host 192.0.2.50
logging trap informational
logging buffered 64000 informational
logging source-interface Vlan999
!
aaa new-model
tacacs server ise-01
 address ipv4 192.0.2.60
 key <secret>
aaa group server tacacs+ ISE
 server name ise-01
aaa authentication login default group ISE local
aaa authorization exec default group ISE local if-authenticated
aaa accounting commands 15 default start-stop group ISE

archive
 path scp://backup@192.0.2.40/cisco/$h-$t
 write-memory                            ! archive on every save
 time-period 1440                        ! and daily regardless
 log config
  logging enable
  logging size 500
  hidekeys
  notify syslog contenttype plaintext

copy running-config scp://backup@192.0.2.40/cisco/sw-01.cfg      ! one-off, prompts for the password
copy running-config tftp://192.0.2.40/sw-01.cfg                   ! plaintext transport; lab or isolated management network only
copy running-config flash:pre-change.cfg                          ! local copy before a change; flash survives a reload
show archive
show archive log config all
show archive config differences flash:archive/sw-01-3 system:running-config
configure replace flash:archive/sw-01-3 list                      ! restore a backup, printing each command

configure terminal
interface GigabitEthernet1/0/1
 description uplink to core-01
 no switchport
 ip address 198.51.100.2 255.255.255.252
 no shutdown
end

interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable

interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport nonegotiate
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999

show interfaces status
show interfaces Gi1/0/1 | include errors|drops|duplex|rate
show interfaces counters errors
show interfaces status err-disabled
clear counters GigabitEthernet1/0/1

vlan 20
 name servers
exit
interface Vlan20
 ip address 192.0.2.1 255.255.255.0
 no shutdown

show vlan brief
show spanning-tree vlan 20
show spanning-tree root
show spanning-tree inconsistentports
spanning-tree vlan 20 root primary

ip route 203.0.113.0 255.255.255.0 198.51.100.1 name to-dc2
show ip route static
show ip route 203.0.113.20

key chain OSPF-KEYS
 key 1
  key-string <secret>
  cryptographic-algorithm hmac-sha-256
!
router ospf 1
 router-id 198.51.100.2
 passive-interface default
 no passive-interface GigabitEthernet1/0/1
 network 198.51.100.0 0.0.0.3 area 0
!
interface GigabitEthernet1/0/1
 ip ospf authentication key-chain OSPF-KEYS

show ip ospf neighbor
show ip ospf interface brief
show ip ospf database

router bgp 65001
 bgp log-neighbor-changes
 neighbor 203.0.113.1 remote-as 64511
 neighbor 203.0.113.1 password <secret>
 address-family ipv4
  network 192.0.2.0 mask 255.255.255.0
  neighbor 203.0.113.1 activate
  neighbor 203.0.113.1 prefix-list TO-PEER out
  neighbor 203.0.113.1 maximum-prefix 1000 90 restart 15

show ip bgp summary
show ip bgp neighbors 203.0.113.1 advertised-routes
show ip bgp neighbors 203.0.113.1 routes
show ip bgp 192.0.2.0/24
clear ip bgp 203.0.113.1 soft in

ip access-list extended MGMT-IN
 permit tcp 192.0.2.0 0.0.0.255 any eq 22
 permit icmp any any echo-reply
 deny   ip any any log
!
interface GigabitEthernet1/0/1
 ip access-group MGMT-IN in

show access-lists MGMT-IN
show ip interface Gi1/0/1 | include access list

reload in 10
! make the change, then verify from a new session
reload cancel

archive
 path flash:archive/$h-
 write-memory
 maximum 14

configure replace flash:intended.cfg time 5
! verify from a new session within 5 minutes
configure confirm

show archive
show archive config differences nvram:startup-config system:running-config
configure replace nvram:startup-config list   ! roll running config back to the saved one, printing each command

ping 203.0.113.7 source Vlan20 repeat 100 size 1400 df-bit
traceroute 203.0.113.7 source Vlan20
show ip arp 203.0.113.7
show mac address-table address 0011.2233.4455
show processes cpu history

access-list 100 permit ip host 192.0.2.10 host 203.0.113.7
debug ip packet 100 detail
undebug all

! Interfaces with protocol down, excluding admin down
show ip interface brief | exclude up|administratively

! Ports with errors
show interfaces counters errors

! Which port a MAC is on, then what that port is
show mac address-table address 0011.2233.4455
show interfaces Gi1/0/7 status

! Configuration differences since the last save
show archive config differences nvram:startup-config system:running-config

! Uptime, image and last reload reason
show version | include uptime|System image|Last reload

! Prefixes received from each BGP peer (PfxRcd column)
show ip bgp summary

! CPU-heavy processes right now
show processes cpu sorted | exclude 0.00%

! Log entries from a point in time
show logging | begin Sep 15 09:

! Confirm an ACL is matching
show ip access-lists MGMT-IN | include matches

! Count configured interfaces
show running-config | count ^interface

! Ports that are up but have no description (undocumented ports)
show interfaces description | include ^Gi.*up +up *$

! Ports that have been down for a long time (candidates to reclaim)
show interfaces | include line protocol is down|Last input

! Trunks and the VLANs actually forwarding on each
show interfaces trunk | begin forwarding

! Every VLAN's SVI state
show ip interface brief | include Vlan

! Port-channels with a member that is not bundled
show etherchannel summary | include \(SU\)|\(SD\)|\(s\)|\(I\)|\(D\)

! Top MAC counts per VLAN (a VLAN with thousands is a candidate for a loop or a flat network)
show mac address-table count

! Spanning-tree root for every VLAN and whether this switch is it
show spanning-tree root

! Ports currently blocking or in a transitional STP state
show spanning-tree | include BLK|LRN|LIS

! Recent topology changes and where the last one came from
show spanning-tree detail | include ieee|occurr|from|is exec

! OSPF neighbours that are not FULL (2WAY on a DR segment is fine)
show ip ospf neighbor | exclude FULL

! BGP peers not Established (State/PfxRcd column shows a word, not a number)
show ip bgp summary | include Idle|Active|Connect|OpenSent

! Routes learned from a BGP peer, count only
show ip bgp neighbors 203.0.113.1 routes | include Total

! Routes by source (connected, static, OSPF, BGP)
show ip route summary

! Default route and where it comes from
show ip route 0.0.0.0

! ARP entries for a subnet, to find who is live
show ip arp 192.0.2.0 255.255.255.0

! Which switch port an IP address is on: ARP for the MAC, then the MAC table
show ip arp 192.0.2.10
show mac address-table address 0011.2233.4455

! DHCP snooping bindings on an access switch (IP to port map without a scan)
show ip dhcp snooping binding

! Interface with the most output drops
show interfaces | include ^[A-Z].*is up|Total output drops

! Half-duplex or 10/100 ports on a gigabit switch (cabling or negotiation problems)
show interfaces status | include a-half|a-100|a-10 |10 |100

! Config lines that will be a problem: telnet, http, plaintext SNMP communities
show running-config | include transport input|ip http|snmp-server community

! Unsaved changes: a non-empty diff means "write memory" is pending
show archive config differences nvram:startup-config system:running-config

! What changed in the last archive interval, with the user
show archive log config all | tail 20

! Type 7 passwords still present (weak encoding; migrate to secret)
show running-config | include password 7

! Free flash before an image copy
dir flash: | include bytes free

! NTP status in one line
show ntp status | include synchronized|stratum

! Environment alarms only
show environment all | include FAULT|Alarm|NOT PRESENT|Critical

! Reload reason and uptime for a stack of switches
show version | include uptime|Last reload|System image

! IOS XE: install-mode packages and whether a reload is pending
show install summary | include IMG|SMU

! Save and archive in one line
write memory

#!/usr/bin/env bash
# ios-backup.sh HOSTS_FILE REPO_DIR: pull running-config from each device and commit changes
# Uses public-key SSH; the device needs "ip ssh pubkey-chain" configured for the backup user.
set -euo pipefail
hosts=$1; repo=$2
cd "$repo"
failed=0
while read -r host; do
  [ -n "$host" ] && [ "${host#\#}" = "$host" ] || continue
  if ! ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "$host" 'terminal length 0
show running-config' 2>/dev/null \
      | sed -E '/^(Building configuration|Current configuration|! Last configuration change|! NVRAM config last updated|ntp clock-period)/d' > "$host.cfg.tmp"; then
    echo "FAILED $host" >&2; rm -f "$host.cfg.tmp"; failed=$((failed + 1)); continue
  fi
  grep -q '^hostname ' "$host.cfg.tmp" || { echo "FAILED $host: no hostname line, output incomplete" >&2; rm -f "$host.cfg.tmp"; failed=$((failed + 1)); continue; }
  mv "$host.cfg.tmp" "$host.cfg"
done < "$hosts"
git add -- '*.cfg'
if git diff --cached --quiet; then echo "no changes"; else
  git diff --cached --stat
  git commit -qm "Config backup $(date -u +%FT%TZ)" && echo "committed"
fi
exit $(( failed > 0 ))

#!/usr/bin/env python3
"""Report interfaces with increasing error counters.

Usage: iface-errors.py hosts.txt [interval_seconds]
Credentials from NET_USER, NET_PASS (and NET_ENABLE if enable is needed).
"""
import os
import sys
import time
from concurrent.futures import ThreadPoolExecutor

from netmiko import ConnectHandler

hosts = [h.strip() for h in open(sys.argv[1]) if h.strip() and not h.startswith("#")]
interval = int(sys.argv[2]) if len(sys.argv) > 2 else 60
WATCH = ("input_errors", "crc", "output_errors", "interface_resets")   # field names from the ntc-templates "show interfaces" template

def snapshot(host):
    dev = {"device_type": "cisco_ios", "host": host, "username": os.environ["NET_USER"],
           "password": os.environ["NET_PASS"], "secret": os.environ.get("NET_ENABLE", ""), "conn_timeout": 10}
    with ConnectHandler(**dev) as c:
        if dev["secret"]:
            c.enable()
        rows = c.send_command("show interfaces", use_textfsm=True)
    if not isinstance(rows, list):
        raise RuntimeError("no TextFSM template match")
    return {r["interface"]: {k: int(r.get(k) or 0) for k in WATCH} for r in rows}

def collect():
    out, errors = {}, {}
    with ThreadPoolExecutor(max_workers=10) as pool:
        for host, res in zip(hosts, pool.map(lambda h: _safe(snapshot, h), hosts)):
            (errors if isinstance(res, Exception) else out)[host] = res
    return out, errors

def _safe(fn, arg):
    try:
        return fn(arg)
    except Exception as exc:  # report per host rather than abort the sweep
        return exc

first, err1 = collect()
time.sleep(interval)
second, err2 = collect()
for host, exc in {**err1, **err2}.items():
    print(f"{host}: ERROR {exc}", file=sys.stderr)
found = False
for host in sorted(set(first) & set(second)):
    for iface, before in first[host].items():
        after = second[host].get(iface)
        if not after:
            continue
        delta = {k: after[k] - before[k] for k in WATCH if after[k] > before[k]}
        if delta:
            found = True
            print(f"{host}\t{iface}\t" + " ".join(f"{k}+{v}" for k, v in delta.items()))
if not found:
    print(f"no counters increased in {interval}s across {len(second)} devices")