|
| 1 | +--- |
| 2 | +name: cisco-ios-patterns |
| 3 | +description: Cisco IOS and IOS-XE review patterns for show commands, config hierarchy, wildcard masks, ACL placement, interface hygiene, and safe change-window verification. |
| 4 | +origin: community |
| 5 | +--- |
| 6 | + |
| 7 | +# Cisco IOS Patterns |
| 8 | + |
| 9 | +Use this skill when reviewing Cisco IOS or IOS-XE snippets, building a |
| 10 | +change-window checklist, or explaining how to collect evidence from a router or |
| 11 | +switch without making the incident worse. |
| 12 | + |
| 13 | +## When to Use |
| 14 | + |
| 15 | +- Reviewing IOS or IOS-XE configuration before a planned change. |
| 16 | +- Choosing read-only `show` commands for troubleshooting. |
| 17 | +- Checking ACL wildcard masks and interface direction. |
| 18 | +- Explaining global, interface, routing process, and line configuration modes. |
| 19 | +- Verifying that a change landed in running config and was saved intentionally. |
| 20 | + |
| 21 | +## Operating Rules |
| 22 | + |
| 23 | +Treat IOS examples as patterns, not paste-ready production changes. Confirm the |
| 24 | +platform, interface names, current config, rollback path, and out-of-band access |
| 25 | +before making changes on a real device. |
| 26 | + |
| 27 | +Prefer this workflow: |
| 28 | + |
| 29 | +1. Capture current state with read-only commands. |
| 30 | +2. Review the exact candidate config. |
| 31 | +3. Confirm management access cannot be locked out. |
| 32 | +4. Apply the smallest change in a maintenance window. |
| 33 | +5. Re-read state, compare to the baseline, then save only after validation. |
| 34 | + |
| 35 | +## Mode Reference |
| 36 | + |
| 37 | +```text |
| 38 | +Router> enable |
| 39 | +Router# show running-config |
| 40 | +Router# configure terminal |
| 41 | +Router(config)# interface GigabitEthernet0/1 |
| 42 | +Router(config-if)# description UPLINK-TO-CORE |
| 43 | +Router(config-if)# no shutdown |
| 44 | +Router(config-if)# exit |
| 45 | +Router(config)# end |
| 46 | +Router# show running-config interface GigabitEthernet0/1 |
| 47 | +``` |
| 48 | + |
| 49 | +`running-config` is active memory. `startup-config` is what survives reload. |
| 50 | +Do not save a change just because a command was accepted; validate behavior |
| 51 | +first, then use `copy running-config startup-config` if the change is approved. |
| 52 | + |
| 53 | +## Read-Only Collection |
| 54 | + |
| 55 | +```text |
| 56 | +show version |
| 57 | +show inventory |
| 58 | +show processes cpu sorted |
| 59 | +show memory statistics |
| 60 | +show logging |
| 61 | +show running-config | section line vty |
| 62 | +show running-config | section interface |
| 63 | +show running-config | section router bgp |
| 64 | +show ip interface brief |
| 65 | +show interfaces |
| 66 | +show interfaces status |
| 67 | +show vlan brief |
| 68 | +show mac address-table |
| 69 | +show spanning-tree |
| 70 | +show ip route |
| 71 | +show ip protocols |
| 72 | +show ip access-lists |
| 73 | +show route-map |
| 74 | +show ip prefix-list |
| 75 | +``` |
| 76 | + |
| 77 | +Collect the specific section you need instead of dumping full config into a |
| 78 | +ticket when the config may contain secrets, customer names, or private topology. |
| 79 | + |
| 80 | +## Wildcard Masks |
| 81 | + |
| 82 | +IOS ACL and many routing statements use wildcard masks, not subnet masks. |
| 83 | + |
| 84 | +```text |
| 85 | +Subnet mask Wildcard mask |
| 86 | +255.255.255.255 0.0.0.0 |
| 87 | +255.255.255.252 0.0.0.3 |
| 88 | +255.255.255.0 0.0.0.255 |
| 89 | +255.255.0.0 0.0.255.255 |
| 90 | +``` |
| 91 | + |
| 92 | +Review wildcard masks before deployment. A subnet mask accidentally used as a |
| 93 | +wildcard can match far more traffic than intended. |
| 94 | + |
| 95 | +```text |
| 96 | +ip access-list extended WEB-IN |
| 97 | + 10 permit tcp 192.0.2.0 0.0.0.255 any eq 443 |
| 98 | + 999 deny ip any any log |
| 99 | +``` |
| 100 | + |
| 101 | +Every ACL has an implicit deny at the end. Add an explicit logged deny when the |
| 102 | +operational goal includes observing misses, and confirm logging volume is safe. |
| 103 | + |
| 104 | +## ACL Placement Review |
| 105 | + |
| 106 | +Before applying an ACL to an interface, answer these questions: |
| 107 | + |
| 108 | +- Which traffic direction is being filtered, `in` or `out`? |
| 109 | +- Is management traffic sourced from a known jump host or management subnet? |
| 110 | +- Is there an explicit permit for required routing, DNS, NTP, monitoring, or |
| 111 | + application traffic? |
| 112 | +- Are hit counters available from a safe test source? |
| 113 | +- Is there a rollback command and an active console or out-of-band path? |
| 114 | + |
| 115 | +Do not test reachability by removing firewall or ACL protections. Read counters, |
| 116 | +logs, and route state first. |
| 117 | + |
| 118 | +## Interface Hygiene |
| 119 | + |
| 120 | +```text |
| 121 | +interface GigabitEthernet0/1 |
| 122 | + description UPLINK-TO-CORE |
| 123 | + switchport mode trunk |
| 124 | + switchport trunk allowed vlan 10,20,30 |
| 125 | + switchport trunk native vlan 999 |
| 126 | + no shutdown |
| 127 | +``` |
| 128 | + |
| 129 | +Use clear descriptions, explicit switchport mode, and documented native VLANs. |
| 130 | +On routed interfaces, confirm the mask, peer addressing, and routing process |
| 131 | +before assuming link state means forwarding is correct. |
| 132 | + |
| 133 | +## Change-Window Verification |
| 134 | + |
| 135 | +Use before/after checks that match the actual change. |
| 136 | + |
| 137 | +```text |
| 138 | +show running-config | section interface GigabitEthernet0/1 |
| 139 | +show interfaces GigabitEthernet0/1 |
| 140 | +show logging | include GigabitEthernet0/1|changed state|line protocol |
| 141 | +show ip route <prefix> |
| 142 | +show ip access-lists <name> |
| 143 | +``` |
| 144 | + |
| 145 | +For routing changes, also capture neighbor state and route tables before and |
| 146 | +after the change. For ACL changes, compare hit counters from a planned test |
| 147 | +source rather than relying on a generic ping. |
| 148 | + |
| 149 | +## Anti-Patterns |
| 150 | + |
| 151 | +- Applying a generated config without a device-specific diff. |
| 152 | +- Saving configuration before post-change checks pass. |
| 153 | +- Using a subnet mask where IOS expects a wildcard mask. |
| 154 | +- Applying an ACL to the wrong interface direction. |
| 155 | +- Troubleshooting by disabling ACLs, route policies, or authentication. |
| 156 | +- Pasting full configs into public tools without sanitizing secrets and topology. |
| 157 | + |
| 158 | +## See Also |
| 159 | + |
| 160 | +- Agent: `network-config-reviewer` |
| 161 | +- Agent: `network-troubleshooter` |
| 162 | +- Skill: `network-config-validation` |
| 163 | +- Skill: `network-interface-health` |
0 commit comments