cisco-ios-patterns
Cisco IOS and IOS-XE review patterns for show commands, config hierarchy, wildcard masks, ACL placement, interface hygiene, and safe change-window verification.
Security Assessment
About cisco-ios-patterns
cisco-ios-patterns provides review patterns for Cisco IOS and IOS-XE work, covering show commands, config hierarchy, wildcard masks, ACL placement, interface hygiene, and safe change-window verification. It solves the problem of reviewing router and switch configurations and collecting troubleshooting evidence without making an incident worse, by treating all examples as patterns rather than paste-ready production changes. It applies when reviewing IOS or IOS-XE snippets before a planned change, choosing read-only show commands, checking ACL wildcard masks and interface direction, explaining configuration modes, or verifying that a change landed in the running config and was saved intentionally.
The skill lays out a safe operating workflow: capture current state with read-only commands, review the exact candidate config, confirm management access cannot be locked out, apply the smallest change in a maintenance window, then re-read state, compare to baseline, and save only after validation. It includes a mode reference showing the enable, configure terminal, interface, and line configuration hierarchy, and clarifies that running-config is active memory while startup-config survives reload, using copy running-config startup-config only after validation. It provides a curated set of read-only collection commands (such as show version, show ip interface brief, show running-config | section interface, show ip access-lists), a subnet-to-wildcard mask conversion table with a warning that a subnet mask used as a wildcard can match far more traffic than intended, ACL placement review questions (direction, management source, explicit permits, hit counters, rollback path), interface hygiene guidance, and change-window before/after checks.
Target users are network engineers and reviewers working on Cisco IOS or IOS-XE devices who want to prepare change-window checklists and gather evidence safely. The skill enumerates anti-patterns such as applying generated config without a device-specific diff, saving before post-change checks pass, using a subnet mask where a wildcard is expected, applying an ACL to the wrong direction, and troubleshooting by disabling ACLs or authentication. It requires confirming the platform, interface names, current config, rollback path, and out-of-band access before making real changes, and references related agents (network-config-reviewer, network-troubleshooter) and skills (network-config-validation, network-interface-health).
FAQ
What safe workflow does the skill recommend for changes?
Capture current state with read-only commands, review the exact candidate config, confirm management access cannot be locked out, apply the smallest change in a maintenance window, then re-read state, compare to the baseline, and save only after validation.
What is the difference between running-config and startup-config?
running-config is active memory (the currently active configuration) while startup-config is what survives a reload. The skill advises not to save a change just because a command was accepted; validate behavior first, then use copy running-config startup-config only if the change is approved.
Why does it emphasize wildcard masks?
IOS ACLs and many routing statements use wildcard masks, not subnet masks. The skill provides a conversion table and warns that a subnet mask accidentally used as a wildcard can match far more traffic than intended, so wildcard masks should be reviewed before deployment.
What should be checked before applying an ACL to an interface?
Which direction is being filtered (in or out), whether management traffic comes from a known jump host or management subnet, whether there is an explicit permit for required routing/DNS/NTP/monitoring/application traffic, whether hit counters are available from a safe test source, and whether there is a rollback command and an active console or out-of-band path.
What anti-patterns does the skill warn against?
Applying generated config without a device-specific diff, saving configuration before post-change checks pass, using a subnet mask where IOS expects a wildcard mask, applying an ACL to the wrong interface direction, troubleshooting by disabling ACLs/route policies/authentication, and pasting full configs into public tools without sanitizing secrets and topology.
Install cisco-ios-patterns
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
affaan-m/everything-claude-code