Which command places the switch in global configuration mode?
You’ve probably been staring at a blinking cursor on a network switch and wondering how to get to the right place to start typing your first command. If you’re working with Cisco IOS, the answer is simple: type configure terminal (or the shorthand conf t). But that’s just the tip of the iceberg. Let’s dig into what global configuration mode actually is, why it matters, and how to avoid the common pitfalls that trip up even seasoned pros.
What Is Global Configuration Mode
In the world of switches, you’re constantly juggling several layers of configuration. Think of the command line as a set of rooms: the user EXEC mode is the front desk, the privileged EXEC mode (the “enable” prompt) is the manager’s office, and global configuration is the boardroom where you make the big decisions.
When you’re in global configuration mode, every command you type affects the device as a whole—unless you’re in a specific sub‑interface or VLAN configuration block. It’s the place where you define hostnames, enable features, set passwords, and create VLANs that will be visible across the entire switch Surprisingly effective..
How It Differs From Other Modes
| Mode | Prompt | Typical Tasks |
|---|---|---|
| User EXEC | Switch> |
Basic monitoring (show commands) |
| Privileged EXEC | Switch# |
Full control, but still outside the configuration tree |
| Global Configuration | Switch(config)# |
System‑wide settings, feature enablement |
| Interface/ VLAN | Switch(config-if)# or Switch(config-vlan)# |
Settings that apply to a single interface or VLAN |
Knowing which mode you’re in is critical because a command that works in one mode might be ignored or even cause an error in another.
Why It Matters / Why People Care
You might think “I’ll just type the command I need and call it a day.” But if you’re in the wrong mode, your command won’t stick. On top of that, imagine configuring a new VLAN on the user prompt—nothing happens, and you’re left scratching your head. Or worse, you’re in global config and accidentally enable a feature that you didn’t intend to, causing a network outage.
In practice, the global configuration mode is where the switch’s personality is defined. A mis‑typed command here can ripple across the network: wrong VLAN assignments, misconfigured spanning‑tree settings, or even security holes. That’s why the community places a lot of emphasis on mastering the entry into this mode.
How It Works (or How to Do It)
1. Log In and Enter Privileged EXEC
First, you need to be at the privileged prompt (Switch#). If you’re only at the user prompt (Switch>), type:
enable
You’ll be prompted for a password. Once you’re in, the prompt changes to Switch# Simple as that..
2. Switch to Global Configuration
From the privileged prompt, enter:
configure terminal
or its shorthand:
conf t
You’ll see the prompt change to Switch(config)#. That’s your green light to start making system‑wide changes Worth keeping that in mind..
3. Verify You’re in the Right Mode
A quick sanity check: type show running-config | section hostname. If you’re in global config, the command will return the current hostname. If you’re in a sub‑mode, you’ll get an error or a different output Which is the point..
4. Exit Back to Normal
When you’re done, type:
end
or press Ctrl+Z. The prompt will return to Switch#.
Common Mistakes / What Most People Get Wrong
-
Forgetting to
enablefirst – If you’re still atSwitch>,configure terminalwill refuse you. Always start withenable. -
Using the wrong shorthand – Some people type
confinstead ofconf t. The former won’t work; the latter is the accepted shortcut Simple as that.. -
Assuming you’re in global config when you’re in a sub‑mode – After creating a VLAN with
vlan 10, you’re dropped intoSwitch(config-vlan)#. To exit, you needexittwice, not just once. -
Editing the wrong file –
configure terminaledits the running-config. If you need to persist changes, remember towrite memoryorcopy running-config startup-config. -
Mixing Cisco and Huawei syntax – On Huawei devices, the command is
system view. Mixing the two will lead to confusion and frustration Turns out it matters..
Practical Tips / What Actually Works
- Keep a cheat sheet. A quick reference card with
enable,configure terminal,end, andwrite memorysaves time during troubleshooting. - Use
terminal length 0. When you’re pulling long config outputs, this prevents paging and lets you scroll freely. - put to work
show running-config. After making a change, always verify it’s there. It’s the fastest sanity check. - Remember
nocommands. To delete a setting, prependnoto the command you want to reverse. To give you an idea,no vlan 10removes VLAN 10. - Pinpoint errors with
debug. If a command hangs,debug allcan reveal why, but use it sparingly—debug can flood your console.
FAQ
Q1: What if I’m using a switch from a different vendor?
A1: Vendors differ. Huawei uses system view, Juniper uses configure, and Aruba uses configure. Always check the vendor’s documentation.
Q2: Can I skip the enable step?
A2: No. The enable command is the gateway to privileged EXEC, which is required to enter global configuration. Without it, you’re stuck at the user level Most people skip this — try not to. Nothing fancy..
Q3: Is configure terminal the same as conf t on all platforms?
A3: On Cisco IOS and many derivatives, yes. Some older or specialized platforms may not support the shorthand, so it’s safer to use the full command.
Q4: How do I save my configuration after exiting global mode?
A4: Use write memory or copy running-config startup-config. This writes the current running config to NVRAM so it survives reboots.
Q5: What happens if I accidentally delete the wrong configuration?
A5: If you delete the wrong line, you can usually recover by re‑entering the command. If you delete critical settings like VLANs or passwords, you may need to re‑configure or restore from a backup.
Closing
Getting into global configuration mode is a rite of passage for anyone who wants to tinker with switches. On top of that, it’s the command that unlocks the device’s full potential, but it also carries responsibility. Think about it: treat it with respect, double‑check your prompts, and you’ll be on your way to mastering your network’s backbone. Happy configuring!
6. Common Pitfalls When Leaving Global Config Mode
Even after you’ve successfully entered configure terminal, the work isn’t done. The next step—exiting cleanly—can be just as error‑prone as getting in.
| Symptom | What’s really happening | Fix |
|---|---|---|
“% Invalid input detected at ‘#’” when you type exit |
You’re still in a sub‑mode (e.Worth adding: g. Day to day, , interface, line, or router config) and the parser expects a command that belongs to that context. | Type end to jump straight back to privileged EXEC, or issue enough exit commands to climb the hierarchy. Practically speaking, |
| Changes disappear after a reboot | You edited the running configuration but never saved it. On top of that, | Run write memory (or copy running-config startup-config) before you power cycle the device. |
Prompt returns to Switch> instead of Switch# |
You inadvertently typed disable or logged out of privileged EXEC. |
Re‑enter enable and supply the enable secret/password. |
conf t is not recognized on a non‑Cisco device |
The device uses a different CLI syntax. Because of that, | Consult the vendor’s command reference; for Huawei it’s system view, for Juniper it’s configure, etc. |
terminal length 0 has no effect |
You’re in a sub‑mode that overrides the global terminal settings (e.g.Consider this: , line console). |
Issue terminal length 0 from privileged EXEC before dropping into any sub‑mode. |
Counterintuitive, but true.
7. Automation Friendly Ways to Jump Into Global Config
If you’re managing dozens of switches, typing the same sequence over and over is a recipe for fatigue and mistakes. Here are three automation‑friendly approaches that still respect the “enter‑global‑config‑mode” principle But it adds up..
-
Expect Scripts (Linux/macOS/Windows Subsystem for Linux)
#!/usr/bin/expect -f set timeout 10 spawn ssh admin@10.0.0.1 expect "Password:" send "mySecret\r" expect ">" send "enable\r" expect "Password:" send "enableSecret\r" expect "#" send "configure terminal\r" expect "(config)#" # Insert any configuration lines here, e.g.: send "interface vlan 10\r" send "ip address 192.168.10.1 255.255.255.0\r" send "no shutdown\r" send "end\r" send "write memory\r" expect "#" send "exit\r" expect eofThe script logs in, elevates, drops into global config, pushes a handful of commands, saves, and exits—all without a single manual keystroke But it adds up..
-
Ansible Network Modules
Ansible’sios_config(oreos_config,junos_config, etc.) abstracts the “enter config mode” step. You simply declare the desired lines:- name: Configure VLAN 20 on Cisco switches ios_config: lines: - vlan 20 - name Marketing save_when: changedAnsible handles the
enableprompt, theconfigure terminalentry, and the finalwrite memoryfor you. -
Cisco Embedded Event Manager (EEM) Scripts
For on‑device automation, EEM can trigger a config change based on an event (e.g., a syslog message):event manager applet auto_vlan event syslog pattern "LINK-3-UPDOWN" action 1.0 cli command "enable" action 2.0 cli command "configure terminal" action 3.0 cli command "interface $_syslog_msg_interface" action 4.0 cli command "switchport mode access" action 5.0 cli command "switchport access vlan 30" action 6.0 cli command "end" action 7.0 cli command "write memory"The device itself decides when to enter global config, eliminating human latency entirely.
8. Best‑Practice Checklist (One‑Page Summary)
| ✅ | Item |
|---|---|
| 1 | Verify you have privileged EXEC (Switch#). |
| 2 | Confirm you’re on the correct device (IP, hostname). |
| 3 | Enter global config with configure terminal (or vendor‑specific equivalent). That said, |
| 4 | Make atomic changes—one logical block at a time. Still, |
| 5 | Use no to undo unwanted statements rather than deleting large sections. |
| 6 | Immediately verify with show running-config or a targeted show command. |
| 7 | Persist the change: write memory / copy running-config startup-config. |
| 8 | Exit cleanly with end → exit or logout. |
| 9 | Document the change in your change‑management system. |
| 10 | Keep a CLI cheat sheet on your terminal or in a password manager note. |
9. When Things Still Go Wrong
Even seasoned network engineers occasionally hit a wall. Here’s a quick “triage” flow:
-
Prompt not changing?
- Check the console cable/SSH session for line‑mode issues.
- Re‑authenticate; sometimes a stale session loses privileged rights after a timeout.
-
configure terminalreturns an error- Verify the device isn’t in ROMMON or bootloader mode.
- Confirm you’re not on a StackWise member that’s offline.
-
Changes are rejected
- Look for
% Invalid inputmessages; syntax may be wrong for that IOS version. - Use
?for context‑sensitive help.
- Look for
-
Device reboots after a config change
- Check for
boot configoverrides or a corrupted NVRAM image. - Restore from a known‑good backup if the running config can’t be saved.
- Check for
-
Unable to save (
write memoryfails)- Verify there’s enough free space in NVRAM (
dir flash:). - Look for a read‑only filesystem flag caused by a failed power cycle.
- Verify there’s enough free space in NVRAM (
If all else fails, capture the console output (terminal monitor), copy it into a ticket, and involve a senior engineer. The CLI is deterministic; the missing piece is usually a tiny oversight.
Conclusion
Entering global configuration mode (configure terminal) is more than a rote command—it’s the gateway that transforms a passive network appliance into a fully programmable building block. By understanding the underlying privilege levels, respecting the hierarchy of sub‑modes, and consistently saving your work, you avoid the most common “I broke the network” moments. In real terms, pair the command with a disciplined workflow: cheat‑sheet at hand, verification after every edit, and a habit of persisting changes. Whether you’re typing manually, scripting with Expect, or automating with Ansible or EEM, the same principles apply: gain privileged access, enter the correct configuration context, make precise changes, verify, save, and exit cleanly.
Master this sequence, and you’ll find that the once‑intimidating “global config” prompt becomes a familiar launchpad for every network enhancement you need to implement. Happy configuring!
10. Best‑Practice Checklist for Every configure terminal Session
| ✅ Item | Why It Matters | Quick Test |
|---|---|---|
| Log into a dedicated admin account | Reduces the risk of privilege creep and makes audit trails clearer. | `show running-config |
| **Use context‑sensitive help (`?On the flip side, | show logging |
|
Activate archive with log config |
Automatically snapshots every change to a syslog server or local flash. cfg` | |
Close the session with end → exit |
Guarantees you leave the device in a clean state. Practically speaking, | `copy running-config flash:postchange-$(date +%F). Consider this: |
Lock the session with exec-timeout 0 0 (or a short timeout) |
Prevents an idle privileged shell from being hijacked. Plus, ` | |
Validate with do show running-config after each logical block |
Guarantees the change landed where you expect it. | write memory → verify /md5 |
| Document the change in the ticketing system before you exit | Provides traceability for compliance audits. | Type `interface ? |
| Take a post‑change backup | A safety net if the next change unintentionally reverts your work. | `show running-config |
Enable logging console |
Gives you a timestamped record of every command you type. | do show run interface Gi1/0/5 |
Commit to NVRAM only after a successful verify |
Guarantees you won’t lock yourself out with a bad config. `) before pressing Enter** | Catches typos early and shows version‑specific syntax. Which means |
11. Automation Friendly Alternatives
While the manual configure terminal workflow is indispensable for ad‑hoc troubleshooting, most production environments benefit from repeatable, code‑driven changes. Below are three common approaches that still respect the “enter global config” paradigm, but offload the repetitive typing to a tool Worth keeping that in mind..
| Tool | How It Maps to configure terminal |
Example Snippet |
|---|---|---|
| Ansible (network_cli) | Ansible opens an SSH session, escalates to enable, then issues config mode commands automatically. |
yaml - name: Configure VLAN 10 on Cisco<br> ios_config:<br> lines:<br> - name Marketing<br> parents: vlan 10<br> save_when: modified |
| Cisco EEM (Embedded Event Manager) | EEM policies can trigger a cli command "configure terminal" block when a specific event occurs (e.Plus, 255. config_mode()<br> net.Plus, 0 cli command "enable"<br> action 2. Consider this: 0 cli command "configure terminal"<br> action 3. , link down). send_config_set(['interface Loopback0','ip address 10.255.Now, 0. 0 cli command "shutdown"` |
|
| Python + Netmiko / NAPALM | Scripts establish an SSH channel, invoke enter_config_mode(), push a list of commands, then exit_config_mode() and save_config(). 0 cli command "interface GigabitEthernet1/0/1"<br> action 4. |
`event manager applet link-down<br> event syslog pattern "LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down"<br> action 1.g.1','username':'admin','password':'cisco'}<br>with ConnectHandler(**dev) as net:<br> net.10.10.enable()<br> net.255'])<br> net.Practically speaking, 1 255. 0. |
Key takeaway: Even when you automate, the underlying device still expects you to enter configuration mode. Understanding the manual steps makes it easier to debug failed playbooks or scripts Still holds up..
12. Security Hardening Tips Specific to Config Mode
- Limit
privilege execlevels – Assign only the needed commands to a role. - Enable AAA local authentication and point to an external RADIUS/TACACS+ server for audit trails.
- Disable
service password-encryptionif you store clear‑text passwords in a secure vault; otherwise, keep it on to avoid accidental exposure inshow run. - Use
no logging consoleon production devices to prevent sensitive command output from appearing on the console port. - Apply
command authorization exec levelto restrict who can even typeconfigure terminal.
13. Common Gotchas Across IOS Variants
| IOS Family | Gotcha | Fix |
|---|---|---|
| IOS XE (Catalyst 9000) | configure terminal is sometimes aliased to conf t but the alias may be disabled in a custom banner. Think about it: |
|
| NX‑OS | The prompt changes to config instead of config‑term. |
Use the full command or re‑enable the alias with alias exec conf t configure terminal. Think about it: |
| IOS XR | Global config mode is entered with configure (no terminal). Here's the thing — |
Remember: configure → commit → exit. And |
| ASA | configure terminal drops you into a policy context if you’re already in a class‑map. |
Use exit until you reach the global config prompt (#). |
Final Thoughts
The phrase “enter global configuration mode” may seem like a simple technical step, but it encapsulates a disciplined mindset: gain the right level of privilege, operate in the correct hierarchical context, make deliberate edits, verify them, and lock them down permanently. By internalising the checklist, the troubleshooting flow, and the security hardening measures outlined above, you’ll reduce the likelihood of accidental outages, keep audit trails clean, and make life easier for anyone who inherits your configuration Most people skip this — try not to..
Whether you’re typing commands line‑by‑line on a console cable, scripting them with Python, or orchestrating large‑scale changes via Ansible, the same fundamentals apply. Master them, and you’ll find that the “configure terminal” prompt transforms from a source of anxiety into a powerful, predictable gateway to every feature your Cisco device offers.
Happy configuring—may your configs be clean, your commits be saved, and your network always stay up.