Cisco IOS CLI Modes: User, Privileged, Global, Interface, and Line

The IOS command line is a hierarchy, and the prompt tells you where you are in it at all times. A session opens in user EXEC mode at R1>, enable raises it to privileged EXEC at R1#, and configure terminal enters global configuration at R1(config)#. From there, commands that select an object drop you into a configuration submode whose prompt names that object, such as R1(config-if)# for an interface or SW1(config-line)# for a console or vty line. Knowing which prompt a command belongs to matters as much as knowing the command, because IOS rejects the right command typed at the wrong level.

The modes and their prompts

Mode	Prompt	Entered with	What it is for
User EXEC	R1>	Opening a session	Basic show and connectivity commands
Privileged EXEC	R1#	enable	Full show, debug, copy, reload, clear
Global configuration	R1(config)#	configure terminal	Device-wide settings
Interface	R1(config-if)#	interface GigabitEthernet0/1	Settings for one interface
Interface range	SW1(config-if-range)#	interface range ...	The same settings applied to many ports at once
Subinterface	R1(config-subif)#	interface GigabitEthernet0/0.10	Per-VLAN logical interface on a router
Line	SW1(config-line)#	line console 0, line vty 0 15	Terminal access settings
Router	R1(config-router)#	router ospf 1	Routing protocol settings
VLAN	SW1(config-vlan)#	vlan 30	VLAN name and administrative state
ROM monitor	rommon 1>	Break during boot, or missing IOS image	Recovery and password reset

exit moves back one level. end, or the Ctrl-Z key sequence, jumps straight from any configuration submode to privileged EXEC. disable drops privileged EXEC back to user EXEC. The subinterface prompt is the one most candidates meet first while building router-on-a-stick inter-VLAN routing, where a single router interface is divided one logical interface per VLAN.

Configuration submodes are reached only from global configuration or from another submode, which is why entering interface GigabitEthernet0/1 at a > or # prompt fails. The reverse rule is looser: do lets you run an EXEC command without leaving configuration mode, as in R1(config-if)# do show ip interface brief. Two summaries worth knowing by name are show ip interface brief, which prints one line per interface with the IPv4 address and both status columns, and show ipv6 interface brief, which does the same job for IPv6 addressing.

Interface and interface range modes

A single interface is selected by name. Multiple interfaces are selected with interface range, which puts you at the (config-if-range)# prompt and applies every subsequent command to all selected ports:

SW1(config)# interface range GigabitEthernet1/0/1 - 12
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 20

The range syntax accepts a hyphen for a contiguous block and commas to join separate entries. Each comma-separated entry must be written out in full:

SW1(config)# interface range GigabitEthernet1/0/2, GigabitEthernet1/0/5, GigabitEthernet1/0/9 - 12

That selects six ports. Abbreviating later entries to bare numbers, chaining several hyphens, or using the word to instead of a hyphen are all invalid, and dropping the range keyword makes the command an impossible interface name.

VLAN configuration mode

Typing vlan 30 at SW1(config)# creates the VLAN if it does not exist and moves the CLI to SW1(config-vlan)#. Only VLAN-level commands live there:

SW1(config)# vlan 20
SW1(config-vlan)# name ENGINEERING

name attaches a descriptive text label to the VLAN currently being configured. It changes nothing about forwarding, it does not create a VLAN by itself, and it has no relationship to interface descriptions. A VLAN with no name works exactly the same as a named one. Trying to combine creation and naming on one line, or to name a VLAN from interface configuration mode, does not work; the two commands sit at two different prompts.

shutdown is the other subcommand worth knowing here. It stops the VLAN from passing traffic while leaving it in the database, so hosts on its access ports lose connectivity to each other immediately and show vlan brief reports the status as act/lshut rather than active. The ports stay assigned to the VLAN and the VLAN is not deleted. no shutdown at the same prompt restores it. Commands belonging elsewhere, such as switchport access vlan, ip address, or encapsulation dot1Q, are rejected here. More on the VLAN workflow is in Cisco VLAN configuration.

Console and vty access

Initial configuration happens over the console port, which is out-of-band and works before any IP address exists. The physical connection is a rollover console cable, usually presented today as a USB-to-console adapter, and the terminal emulator settings are 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control. That combination is written 9600 8N1 and it is the default on Cisco equipment.

Securing the console is a line-mode job:

SW1(config)# line console 0
SW1(config-line)# password Cons0le!
SW1(config-line)# login

password sets the value and login is what makes the line actually prompt for it. How that value is stored in the configuration file depends on the IOS password type in effect. Configuring one without the other leaves the console either unprotected or unusable. login local is the wrong choice on a device with no local user accounts, because it validates against a username database that does not exist. An enable secret protects the transition into privileged EXEC and does nothing about the console prompt.

The vty lines, reached with line vty 0 15, control Telnet and SSH sessions and take the same password and login pair, or login local once usernames exist. Restricting a line to encrypted access uses transport input ssh. Brute-force attempts against those lines can be throttled from global configuration:

R1(config)# login block-for 120 attempts 4 within 60

That statement means four failed logins inside any 60-second window cause the router to refuse all login attempts for the next 120 seconds. It is not an idle timeout, a session limit, or a password-age policy. Idle disconnection is a separate line command, exec-timeout <minutes> <seconds>.

Console output and name resolution

logging synchronous, entered at a line prompt, reprints whatever you were typing after a console message interrupts. Without it, a link-state message arriving mid-command scrambles the display and you cannot tell what you have already typed. It does not send anything to a syslog server, suppress messages, or touch the clock.

no ip domain-lookup, entered in global configuration, stops the delay that follows a mistyped word at an EXEC prompt. IOS treats an unrecognized word there as a hostname you want to connect to. Name resolution is enabled by default, so with no resolver configured the router broadcasts the query to 255.255.255.255 and waits for the attempt to time out, freezing the session for roughly a minute. Disabling lookups removes the behavior permanently; the Ctrl-Shift-6 escape sequence aborts an attempt already in progress.

Privilege levels

IOS supports levels 0 through 15. User EXEC runs at level 1 and privileged EXEC at level 15, and everything in between is available for custom roles. Three commands build one:

R1(config)# privilege exec level 7 show running-config
R1(config)# enable secret level 7 M0nitor!7
R1(config)# username ops privilege 7 secret Ops!2026

The first moves one command down to level 7. The second sets the password for reaching level 7 with enable 7. The third gives an account that starts its session at level 7. A user logging in on that account gets every level 1 command plus the ones explicitly assigned, so show running-config works while configure terminal does not, because that command still sits at level 15. Defining an enable secret for a level does not grant that level full rights, and an account with a privilege level does not have to type enable to reach the level it was assigned. Password command choices are compared in enable secret versus enable password.

How the 200-301 exam tests this

• Prompt prediction. You are shown a command entered at a stated prompt and asked what the next prompt is. vlan 30 at (config)# yields (config-vlan)#; interface range yields (config-if-range)#. Track the object the command selects.
• Command placed at the wrong prompt. Several answers use correct syntax at an impossible level, such as naming a VLAN from interface mode or entering a line password in global configuration. Read the prompt in each option before the command text.
• Console bring-up details. Cable type and terminal settings are asked directly. Rollover cable with 9600 8N1 and no flow control is the only correct combination.
• Effect of a single command. Items give one command such as logging synchronous, shutdown under a VLAN, or login block-for, and ask precisely what changes. The distractors are plausible-sounding features that belong to other commands.
• Privilege level reasoning. A three-line configuration assigns a command to a level, defines that level’s secret, and creates a user at that level. Work out which commands the resulting session can run and which remain out of reach.

Moving between these modes without pausing to think is the base layer of the command-line fluency the simulation items assume, and it is worth building before any configuration topic. Pair the lab time with CCNA practice questions so the prompt-prediction items feel like review rather than puzzles.

Quick reference

• R1> user EXEC, R1# privileged EXEC, R1(config)# global configuration.
• Submode prompts name the object: (config-if)#, (config-if-range)#, (config-subif)#, (config-line)#, (config-router)#, (config-vlan)#.
• exit steps back one level; end or Ctrl-Z returns to privileged EXEC; do runs an EXEC command from configuration mode.
• interface range accepts hyphens for blocks and commas between fully written entries.
• At (config-vlan)# the useful subcommands are name and shutdown; a shut VLAN reads act/lshut.
• Console access uses a rollover cable at 9600 8N1 with no flow control.
• Console and vty security needs both password and login at the line prompt.
• logging synchronous reprints interrupted input; no ip domain-lookup removes the mistyped-command delay.
• login block-for 120 attempts 4 within 60 locks logins for 120 seconds after 4 failures in 60 seconds.
• Levels run 0 to 15; a level 7 session gets level 1 commands plus whatever was moved to level 7.