In which configuration mode is line console 0 used?

The line console 0 command is entered in Global Config mode on Cisco IOS devices.

SystemGlobal Config

line console 0

Enters line configuration mode for the console port (line 0) to configure console access parameters such as password, timeout, and exec mode.

Definition: line console 0 is a Cisco IOS global config command. Enters line configuration mode for the console port (line 0) to configure console access parameters such as password, timeout, and exec mode.

Overview

The 'line console 0' command is a fundamental Cisco IOS command used to enter line configuration mode for the console port, specifically line 0 (the first and typically only console line on most routers and switches). This command is essential for configuring out-of-band management access to the device, allowing network administrators to set parameters such as passwords, timeout intervals, and privilege levels for console sessions. The console port is a direct physical connection (usually via a rollover cable and RJ-45 or DB-9 connector) that provides access to the device's CLI even when network connectivity is unavailable, making it critical for initial device setup, password recovery, and troubleshooting during network outages.

Unlike virtual terminal lines (VTY) used for Telnet/SSH, the console line is a dedicated asynchronous serial line that does not rely on IP networking, ensuring access when the network stack is misconfigured or down. The command is typically used in global configuration mode, and once entered, the prompt changes to 'Router(config-line)#', indicating that subsequent commands apply to that specific line. Key parameters configured under line console 0 include the 'password' command for authentication, 'login' to require a password, 'exec-timeout' to set idle session timeout, 'logging synchronous' to prevent console messages from interrupting typed input, and 'privilege level' to control command access.

Understanding this command is vital for CCNA and CCNP candidates because it directly impacts device security and manageability; misconfiguration can lock out administrators or leave the device vulnerable. In the broader workflow, after physical connection and initial power-on, the console is the primary means to enter initial configuration (e.g., setting hostname, IP addresses, enabling passwords) via setup mode or CLI. It also plays a key role in password recovery procedures, where the device is booted into ROMmon mode and the configuration register is modified to bypass the startup configuration.

IOS behavior to note: the console line is always line 0 on most platforms, but some modular routers may have multiple console lines (e.g., line console 0/0/0). The 'line console 0' command does not affect the running configuration until parameters are set; exiting line configuration mode returns to global config. Privilege level requirements: entering line configuration mode requires global config access (privilege level 15 or appropriate authorization).

The console line configuration is stored in the running configuration and can be saved to startup configuration with 'copy running-config startup-config'. Common mistakes include forgetting to set a password (leaving the console open), setting an exec-timeout too long (security risk), or not enabling 'logging synchronous' (causing typing confusion during debug output).

Syntax·Global Config

line console 0

When to Use This Command

Setting a password for console access to secure the router's physical port.
Configuring exec-timeout to automatically log out idle console sessions.
Enabling logging synchronous to prevent syslog messages from interrupting command input.
Setting the privilege level for console users to restrict access to commands.

Command Examples

Basic console password and timeout configuration

line console 0
password cisco
login
exec-timeout 5 30

Router(config-line)# password cisco
Router(config-line)# login
Router(config-line)# exec-timeout 5 30
Router(config-line)#

The 'password cisco' sets the console password to 'cisco'. 'login' enables password authentication at login. 'exec-timeout 5 30' sets the EXEC timeout to 5 minutes and 30 seconds.

Enabling logging synchronous and setting privilege level

line console 0
logging synchronous
privilege level 15

Router(config-line)# logging synchronous
Router(config-line)# privilege level 15
Router(config-line)#

'logging synchronous' prevents console messages from interrupting command input. 'privilege level 15' grants full privileged EXEC access to console users.

Understanding the Output

The 'line console 0' command itself does not produce output; it changes the prompt to 'Router(config-line)#'. Subsequent configuration commands are entered under this mode. The 'show running-config | section line con 0' command can be used to verify the configuration.

Look for lines such as 'password cisco', 'login', 'exec-timeout 5 30', 'logging synchronous', and 'privilege level 15'. Ensure the password is not in plaintext if 'service password-encryption' is enabled. A missing 'login' command means no password is required, which is a security risk.

The exec-timeout should be set to a reasonable value (e.g., 5 30) to prevent unauthorized access from idle sessions.

Configuration Scenarios

Basic Console Password and Timeout Configuration

A network engineer needs to secure the console port on a new Cisco router to prevent unauthorized physical access and set an idle timeout to automatically disconnect inactive sessions.

Topology

R1 (Console Port) --- Laptop with terminal emulator

Steps

1.Step 1: Enter global configuration mode: Router> enable
2.Step 2: Enter global config: Router# configure terminal
3.Step 3: Enter line console configuration mode: Router(config)# line console 0
4.Step 4: Set a password for console access: Router(config-line)# password cisco123
5.Step 5: Enable password checking at login: Router(config-line)# login
6.Step 6: Set exec-timeout to 5 minutes: Router(config-line)# exec-timeout 5 0
7.Step 7: Enable logging synchronous to prevent message interruption: Router(config-line)# logging synchronous
8.Step 8: Exit line configuration: Router(config-line)# exit
9.Step 9: Exit global configuration: Router(config)# exit

Configuration

! Full IOS config block
Router(config)# line console 0
Router(config-line)# password cisco123
Router(config-line)# login
Router(config-line)# exec-timeout 5 0
Router(config-line)# logging synchronous
Router(config-line)# end

Verify: Use 'show running-config | section line con 0' to verify. Expected output includes: line con 0, password cisco123, login, exec-timeout 5 0, logging synchronous.

Watch out: If 'login' is not configured, the password is not required even if set. Always include 'login' after setting the password.

Setting Console Privilege Level for Restricted Access

An organization wants to provide junior technicians console access with limited commands (e.g., only show commands) to prevent accidental configuration changes.

Topology

R1 (Console Port) --- Technician Laptop

Steps

1.Step 1: Enter global configuration mode: Router> enable
2.Step 2: Enter global config: Router# configure terminal
3.Step 3: Enter line console configuration mode: Router(config)# line console 0
4.Step 4: Set privilege level to 1 (user EXEC mode): Router(config-line)# privilege level 1
5.Step 5: Set a password: Router(config-line)# password tech123
6.Step 6: Enable login: Router(config-line)# login
7.Step 7: Exit and save: Router(config-line)# end
8.Step 8: (Optional) To allow specific commands at level 1, use 'privilege exec level 1 <command>' globally.

Configuration

! Full IOS config block
Router(config)# line console 0
Router(config-line)# privilege level 1
Router(config-line)# password tech123
Router(config-line)# login
Router(config-line)# end

Verify: Connect via console; after entering password, the prompt should be 'Router>' (user EXEC mode). Commands like 'enable' should be denied. Use 'show privilege' to confirm level 1.

Watch out: Setting privilege level to 1 restricts all commands; to allow specific commands, use 'privilege exec level 1 <command>' in global config. Also, the 'enable' command will not work unless the enable password is known and the user can escalate.

Troubleshooting with This Command

When troubleshooting console access issues, the 'line console 0' configuration is often the first place to investigate. A common symptom is being unable to log in via console even with correct credentials. The first step is to verify the console line configuration using 'show running-config | section line con 0'.

Healthy output should show 'password <encrypted or plaintext>', 'login', and optionally 'exec-timeout' and 'logging synchronous'. If 'login' is missing, the device will not prompt for a password, which is a security risk but also means anyone can access the CLI. If the password is forgotten, the only recovery method is physical access and password recovery procedure (interrupt boot sequence, change config register).

Another issue is the console session timing out too quickly; check 'exec-timeout' value (default is 10 minutes). If set to 0 0, the session never times out, which is a security concern. If the console output is garbled or no output appears, verify baud rate settings (default 9600) on both the device and terminal emulator.

Use 'show line console 0' to display line status, including baud rate, data bits, stop bits, and parity. The 'show line' command also shows the number of active sessions and whether the line is in use. If the console is unresponsive, check if the line is in use by another session (e.g., if someone left a session open).

Use 'clear line console 0' from privileged EXEC mode to reset the line. For issues with 'logging synchronous', if console messages still interrupt typing, ensure the command is applied under the line. Correlate with 'debug' commands: if debugging is enabled, console output may flood; use 'logging synchronous' to mitigate.

In some IOS versions, 'logging synchronous' may not work if 'logging console' is disabled globally. Also, if the console port is physically damaged, no configuration will help; test with a different cable or device. For NX-OS, the equivalent is 'line console' (without line number) and configuration is similar.

In IOS-XE, the syntax is identical to classic IOS. For ASA, console configuration is done via 'line console 0' as well, but with additional parameters like 'authentication' for AAA. Always ensure that after making changes, you test by disconnecting and reconnecting the console session to verify the new settings take effect.

CCNA Exam Tips

Remember that 'line console 0' is used for the physical console port; 'line vty 0 4' is for remote Telnet/SSH access.

The 'login' command is required to enforce password authentication; without it, the password is ignored.

CCNA exam may test that 'exec-timeout 0 0' disables timeout (not recommended for security).

Know that 'logging synchronous' is a common console configuration to improve usability.

Common Mistakes

Forgetting to issue the 'login' command after setting a password, resulting in no authentication.

Setting 'exec-timeout 0 0' thinking it means no timeout, but it actually disables timeout, which is a security risk.

Confusing 'line console 0' with 'line vty 0 4' and applying console-specific commands to VTY lines.

line console 0 vs line vty 0 4

Both commands enter line configuration mode but for different access types: console (direct physical) and VTY (remote Telnet/SSH). They are often compared when configuring device access because they share similar parameters but serve distinct purposes.

Aspect	line console 0	line vty 0 4
Scope	Physical console port (line 0)	Virtual terminal lines 0-4 (5 sessions)
Purpose	Direct local access to device	Remote network access (Telnet/SSH)
Default State	Always available with no password	Enabled but insecure (no transport input)
Security	Requires physical presence	Exposed to network; needs ACL and encryption
Configuration Mode	line console 0	line vty 0 4
Typical Use	Out-of-band management, password recovery	Remote administration, SSH/Telnet access

Use line console 0 when you need to configure local access parameters like console password, exec timeout, or logging settings for the physical port.

Use line vty 0 4 when you need to configure remote access settings such as transport protocols (SSH/Telnet), authentication, ACLs, and idle timeouts for incoming network connections.

Platform Notes

In IOS-XE (e.g., on Catalyst 9000 switches or ISR 4000 routers), the 'line console 0' command syntax and behavior are identical to classic IOS. However, IOS-XE may support additional parameters such as 'speed' for baud rate configuration (e.g., 'speed 115200') which is also available in newer IOS 15.x versions. The output of 'show running-config' may display the password in encrypted form if 'service password-encryption' is enabled.

For NX-OS (e.g., Nexus 9000), the equivalent command is 'line console' (without a line number), as NX-OS typically has only one console line. The configuration mode is entered with 'switch(config)# line console', and parameters like 'password', 'login', 'exec-timeout', and 'logging synchronous' are supported. However, NX-OS uses a different default timeout (0 0, meaning no timeout) and may require 'login local' for local authentication.

For ASA (Adaptive Security Appliance), the command is also 'line console 0' in global configuration mode, but ASA uses 'password' and 'login' similarly. ASA also supports 'exec-timeout' and 'logging synchronous'. Note that ASA has a separate 'console timeout' command under 'config t' for HTTP console.

In IOS-XR (e.g., ASR 9000), the console configuration is done via 'line console' under 'admin' configuration mode, not the standard CLI. The syntax differs significantly: 'admin' mode, then 'line console', then 'exec-timeout', 'password', etc. IOS-XR also uses 'commit' to apply changes. For older IOS 12.x versions, the command is the same, but some features like 'logging synchronous' were introduced later.

Always check the specific platform documentation, but the core concept remains consistent across Cisco platforms.

Related Commands

exec-timeout [min] [sec]

Sets the inactivity timeout for an EXEC session on a line, automatically logging out idle users to free up resources and enhance security.

line vty 0 4

Enters line configuration mode for virtual terminal (VTY) lines 0 through 4 to configure remote access settings like Telnet/SSH, ACLs, and timeout parameters.

logging synchronous

Prevents console and VTY line output from being interrupted by unsolicited system messages, ensuring that command output remains readable.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions