Cisco IOS / IOS-XEConfig2,855 downloads

Cisco IOS Base / Day-0 Config

Complete day-zero configuration for Cisco IOS/IOS-XE routers and switches. Includes hostname, domain, users, NTP, DNS, logging, SSH, SNMP, and login banner.

↓ example.txt

What is it?

A Day-0 (or base) configuration is the minimum set of settings every Cisco IOS router or switch should have before being deployed in production. It covers identity (hostname, domain), secure management access (SSH only, no Telnet), authentication (local users, enable secret), time synchronization (NTP), logging (syslog), and basic hardening (disable unused services). Without a base config, a device ships with insecure defaults — HTTP server enabled, no login banner, no SSH, CDP broadcasting device info to everyone.

When to use

·First thing after unboxing any new Cisco IOS/IOS-XE router or switch
·Before connecting any device to a production network
·After a factory reset or OS upgrade that clears the configuration
·As part of a Zero Touch Provisioning (ZTP) or NETCONF automation pipeline

When NOT to use

·This IS always needed — there is no scenario where skipping the base config is appropriate in production

How it compares

vs Cisco ASA base configASA base config focuses on firewall-specific settings (nameif, security-level, failover). IOS base config focuses on routing/switching fundamentals. Both share SSH, NTP, logging, and AAA patterns.

vs Cisco NX-OS base configNX-OS uses 'feature' commands to enable protocols (feature ospf, feature bgp). IOS has most protocols enabled by default. NX-OS also uses VDCs and has a different CLI structure for management.

Prerequisites

→Console cable and terminal emulator (PuTTY, SecureCRT) for initial access
→IP addressing plan — know the management IP before starting
→NTP server IPs — time sync is critical for logging and certificates
→Syslog server IP if centralized logging is required

Config Generator

Hostname *

Device hostname (no spaces)

Domain Name *

Used for SSH key generation

Enable Secret *

Privileged EXEC password (stored hashed)

Local Users

Management Interface *

Interface for management traffic

Management IP *

Management Subnet Mask *

Default Gateway

NTP Servers

DNS Servers

Syslog Server IP

Timezone

Displayed before login prompt

Verification commands

show version

Verify IOS version, uptime, and hardware model

ExpectedShows IOS version, device model, RAM, flash, and uptime since last reload

show ip ssh

Verify SSH is enabled and running version 2

ExpectedShould show 'SSH Enabled - version 2.0'. If version 1.99, RSA key may be too small.

show ntp status

Verify NTP synchronization

ExpectedShould show 'Clock is synchronized' with the reference NTP server IP

show logging

Verify syslog is configured and sending to the right server

ExpectedShows logging host IP and trap level. Check 'Trap logging: level informational'.

show users

Show currently logged-in users and their access method

ExpectedLists active console and VTY sessions with username and source IP

Debug commands

show running-config | section line vty

Verify VTY lines are configured for SSH only and local authentication

Common mistakes & fixes

SymptomCannot SSH — 'connection refused' or timeout

CauseRSA key not generated, SSH not enabled, or VTY lines not configured for SSH

FixRun 'crypto key generate rsa modulus 2048', then 'ip ssh version 2'. Verify VTY has 'transport input ssh' and 'login local'.

SymptomNTP not synchronizing

CauseNTP server unreachable from management interface, or firewall blocking UDP 123

FixTest reachability: 'ping <ntp-server> source <mgmt-interface>'. Check for ACLs blocking UDP 123.

SymptomEnable secret not working after config

Cause'service password-encryption' encrypted the enable secret a second time, or wrong password typed

FixVerify with 'show run | include enable'. Use console access to reset if locked out.

SymptomSyslog messages not appearing on server

CauseWrong syslog server IP, wrong source interface, or UDP 514 blocked

FixVerify 'show logging' shows the correct host. Add 'logging source-interface <mgmt-if>' to use the correct source IP.

Further learning

Recommended books to go deeper on this topic.

CCNA 200-301 Official Cert Guide Library

Wendell Odom · Cisco Press · Best starting point for Cisco IOS fundamentals — CLI, interfaces, basic routing

Kindle ↗Hardcover ↗

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · For engineers ready to go deeper — routing, switching, security, automation