Courseiva
InterfacesInterface Config

shutdown

Disables an interface, preventing it from sending or receiving traffic, typically used for administrative shutdown or troubleshooting.

Definition: shutdown is a Cisco IOS interface config command. Disables an interface, preventing it from sending or receiving traffic, typically used for administrative shutdown or troubleshooting.

Overview

The 'shutdown' command in Cisco IOS is used to administratively disable an interface, preventing it from sending or receiving any traffic. This command is fundamental for network engineers to control interface state, often used for maintenance, troubleshooting, or security purposes. When an interface is shut down, it enters an administratively down state, which is distinct from a line protocol down caused by a physical issue.

The command is executed in interface configuration mode and immediately affects the operational state of the interface. It is commonly used to isolate a faulty device, prepare for cabling changes, or disable unused ports to enhance security. The 'shutdown' command is the opposite of 'no shutdown', which enables the interface.

Understanding the difference between administrative and operational down states is crucial for accurate troubleshooting. The command requires privileged EXEC access (enable mode) and modifies the running configuration; changes are lost unless saved to startup configuration. The interface remains administratively down until explicitly enabled with 'no shutdown'.

This command is available on all Cisco IOS platforms, including routers and switches, and is a staple in network configuration and troubleshooting workflows. It is often the first step in isolating a network problem, as it cleanly disables the interface without affecting other configurations. The command also impacts routing protocols, as OSPF or EIGRP neighbors will go down when the interface is shut.

In a production network, shutting down an interface can cause traffic disruption, so it should be used with caution. The 'shutdown' command is also useful during initial device setup to prevent accidental connectivity until the configuration is complete. It is a simple yet powerful tool that every network engineer must master.

Syntax·Interface Config
shutdown

When to Use This Command

  • Disabling a switch port connected to a decommissioned device to prevent unauthorized access.
  • Shutting down a router interface during maintenance to avoid routing loops or traffic blackholing.
  • Temporarily disabling a port to test connectivity issues without unplugging cables.
  • Disabling unused ports on a switch for security hardening.

Command Examples

Shutdown a GigabitEthernet interface

shutdown
%LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to administratively down
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down

The first message indicates the interface was administratively disabled. The second confirms the line protocol is down, meaning no Layer 2 keepalives are exchanged.

Shutdown and verify with show interfaces

shutdown
Router(config-if)# shutdown
Router(config-if)# end
Router# show interfaces gigabitEthernet 0/1
GigabitEthernet0/1 is administratively down, line protocol is down
  Hardware is Gigabit Ethernet, address is 0011.2233.4455 (bia 0011.2233.4455)
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255

The first line of output shows 'administratively down' indicating the shutdown command was applied. The line protocol is down as a result. Other fields like MTU, bandwidth, and load are still displayed but irrelevant since the interface is disabled.

Understanding the Output

When you issue the 'shutdown' command, the router immediately generates syslog messages indicating the interface state changed to 'administratively down' and the line protocol went down. In 'show interfaces' output, the key field is the first line: 'GigabitEthernet0/1 is administratively down, line protocol is down'. The phrase 'administratively down' is the critical indicator that the shutdown command was applied.

A normal 'down' state (without 'administratively') would indicate a physical layer issue. The line protocol being down is expected because the interface is disabled. In a production network, you should verify that the interface is indeed administratively down before assuming it's a physical fault.

Watch for 'up/up' when you intend to disable an interface—that means the shutdown command was not applied or was reversed with 'no shutdown'.

Configuration Scenarios

Administratively disable a switch port to prevent unauthorized access

A network administrator needs to disable an unused switch port in a public area to prevent unauthorized devices from connecting to the network.

Topology

Switch1(Gi0/1)---unused

Steps

  1. 1.Step 1: Enter privileged EXEC mode: Switch> enable
  2. 2.Step 2: Enter global configuration mode: Switch# configure terminal
  3. 3.Step 3: Enter interface configuration mode for GigabitEthernet0/1: Switch(config)# interface gigabitEthernet 0/1
  4. 4.Step 4: Shut down the interface: Switch(config-if)# shutdown
  5. 5.Step 5: Exit configuration mode: Switch(config-if)# end
  6. 6.Step 6: (Optional) Save the configuration: Switch# copy running-config startup-config
Configuration
!
Switch# configure terminal
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# shutdown
Switch(config-if)# end
Switch#

Verify: Use 'show interfaces gigabitEthernet 0/1' and look for 'administratively down' in the line status. Expected output: 'GigabitEthernet0/1 is administratively down, line protocol is down'

Watch out: Forgetting to save the configuration after shutdown; the interface will come back up after a reload if not saved.

Shut down a router interface for maintenance without removing configuration

A network engineer needs to replace a fiber optic cable connected to a router interface. The interface should be disabled to prevent errors during cable replacement, but the configuration must remain intact.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Access the router: R1> enable
  2. 2.Step 2: Enter global configuration mode: R1# configure terminal
  3. 3.Step 3: Enter interface configuration mode: R1(config)# interface gigabitEthernet 0/0
  4. 4.Step 4: Shut down the interface: R1(config-if)# shutdown
  5. 5.Step 5: Exit configuration mode: R1(config-if)# end
  6. 6.Step 6: Perform the cable replacement.
  7. 7.Step 7: Re-enable the interface: R1# configure terminal, R1(config)# interface gigabitEthernet 0/0, R1(config-if)# no shutdown
  8. 8.Step 8: Verify the interface is up: R1# show interfaces gigabitEthernet 0/0
Configuration
!
R1# configure terminal
R1(config)# interface gigabitEthernet 0/0
R1(config-if)# shutdown
R1(config-if)# end
! ... after maintenance ...
R1# configure terminal
R1(config)# interface gigabitEthernet 0/0
R1(config-if)# no shutdown
R1(config-if)# end
R1#

Verify: After shutdown: 'show interfaces gigabitEthernet 0/0' shows 'administratively down'. After no shutdown: 'show interfaces gigabitEthernet 0/0' shows 'up, line protocol is up' (assuming physical connectivity is restored).

Watch out: If the interface is part of a port-channel, shutting down a member interface may cause traffic disruption; always consider the impact on aggregated links.

Troubleshooting with This Command

The 'shutdown' command is primarily used to administratively disable an interface, but it is also a key troubleshooting tool. When an interface is not working as expected, a network engineer may use 'shutdown' followed by 'no shutdown' to reset the interface, clearing any transient errors or protocol state issues. This is often called a 'bounce' of the interface.

Healthy output from 'show interfaces' for an administratively down interface shows 'administratively down, line protocol is down'. If the interface is up but experiencing problems, the output may show 'up, line protocol down' (indicating Layer 1 is good but Layer 2 issues) or 'up, line protocol up' with increasing error counters. The 'shutdown' command can help isolate whether the issue is physical or logical.

For example, if an interface is 'up, line protocol down', bouncing the interface can sometimes re-establish the protocol. However, if the problem persists, it indicates a physical or configuration issue. Common symptoms that lead to using 'shutdown' include: interface flapping (up/down repeatedly), high error rates, or neighbor adjacency drops.

A step-by-step diagnostic flow: 1) Check interface status with 'show interfaces'. 2) If the interface is administratively down, use 'no shutdown' to enable it. 3) If the interface is up but protocol down, check cable, duplex mismatch, or encapsulation. 4) As a last resort, bounce the interface with 'shutdown' and 'no shutdown'. 5) Correlate with 'show logging' to see if there are interface state changes. The 'shutdown' command is also useful for testing failover scenarios; by shutting down an interface, you can verify that routing protocols converge correctly. In summary, 'shutdown' is not just for disabling interfaces; it is a diagnostic tool to reset interface state and isolate problems.

CCNA Exam Tips

1.

CCNA exam tip: The 'shutdown' command is used in interface configuration mode; remember that 'no shutdown' enables the interface.

2.

CCNA exam tip: In the output of 'show interfaces', 'administratively down' always means the shutdown command was applied, not a physical problem.

3.

CCNA exam tip: You may be asked to troubleshoot why an interface is down; distinguish between 'administratively down' (shutdown) and 'down/down' (cable or peer issue).

4.

CCNA exam tip: On switches, shutdown can be applied to both physical ports and VLAN interfaces (SVIs).

Common Mistakes

Mistake: Forgetting to use 'no shutdown' after configuring an interface, leaving it disabled unintentionally.

Mistake: Applying shutdown to a trunk port without verifying it's safe, causing disruption to multiple VLANs.

Mistake: Confusing 'shutdown' with 'reload' or 'poweroff'—shutdown only disables the interface, not the device.

shutdown vs no shutdown

The 'shutdown' and 'no shutdown' commands are commonly confused because they are exact opposites yet are used in the same configuration mode to control the administrative state of an interface. Understanding their distinct effects is essential for proper interface management and troubleshooting.

Aspectshutdownno shutdown
ScopeInterface-level, disables all trafficInterface-level, enables traffic forwarding
Configuration modeInterface configuration modeInterface configuration mode
PersistenceSaved in running-config and startup-configSaved in running-config and startup-config
PrecedenceOverrides line protocol state, forces administratively downAllows line protocol to determine operational state
Typical useAdministrative shutdown for maintenance or securityEnable interface after configuration or recovery

Use shutdown when you need to administratively disable an interface to prevent any traffic flow, such as during maintenance or to isolate a security issue.

Use no shutdown when you need to bring an interface back online after it has been administratively disabled, typically after configuration changes or troubleshooting.

Platform Notes

In IOS-XE, the 'shutdown' command behaves identically to classic IOS. The syntax and output are the same. In NX-OS, the equivalent command is also 'shutdown' under interface configuration mode.

However, NX-OS uses different interface naming conventions (e.g., Ethernet1/1). The 'shutdown' command is available on Cisco ASA firewalls as well, but it is used on physical interfaces and subinterfaces. On ASA, the command is 'shutdown' in interface configuration mode, and the output of 'show interface' will show 'administratively down'.

In IOS-XR, the command is 'shutdown' as well, but the configuration mode is slightly different: you must enter the interface configuration submode using 'interface GigabitEthernet0/0/0/0' and then issue 'shutdown'. The behavior is consistent across platforms: the interface is disabled until 'no shutdown' is applied. There are no significant differences between IOS versions 12.x, 15.x, and 16.x for this command.

The 'shutdown' command is one of the most universal and stable commands in Cisco IOS.

Related Commands

no shutdown

Enables an interface that has been administratively disabled, allowing it to forward traffic and participate in network operations.

show interfaces

Displays detailed Layer 1 and Layer 2 statistics for all interfaces or a specific interface: line protocol state, hardware type, MAC address, MTU, bandwidth, duplex, speed, input/output rates, error counters, and queue statistics.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions