Arista EOS CLI Commands Cheat Sheet: VLAN, STP and Security

Arista EOS is a Linux-based network operating system used across data center, cloud and AI fabrics, and its CLI stays close to IOS-style syntax while adding Linux-friendly automation hooks such as eAPI and gNMI. This cheat sheet collects the EOS commands network engineers reach for most often - management access, VLAN and trunk configuration, spanning tree, security features and routing - with one-line examples for each task.

Treat this as the page you keep open in a second tab during a change window. Every section below lists the exact keyword, the configuration mode it lives in, and the one behaviour that catches people out when a change silently refuses to take effect. Commands assume EOS is running the default multi-agent routing model; placeholder values are shown in angle brackets so you can strip them before pasting into a script. Long forms are used once and short forms afterwards, exactly as you would type them on a console.

How to Read This Cheat Sheet

EOS keeps the familiar mode ladder: user EXEC (switch>), privileged EXEC (switch#), global configuration (switch(config)#), interface configuration (switch(config-if-Et1)) and protocol sub-modes such as config-vlan-10. Three things differ from IOS in ways that matter daily:

• EOS is Linux underneath. Type bash at the prompt to drop to a shell and treat the running configuration as a plain text file at /mnt/flash/startup-config, which is why backing up, diffing and templating configs feels like ordinary file work.
• Interfaces use their real names - Ethernet1, Vlan10, Port-Channel10 - and abbreviate aggressively, so int et1 and int vlan10 are unambiguous.
• Range syntax is not IOS range syntax. Use interface Ethernet3-4 for a contiguous block instead of interface range.

Unless a mode is shown, assume every block runs under configure terminal. Persist changes with write memory.

Management and Access Security

switch> enable
switch# configure terminal
switch(config)# hostname sw-leaf-01
switch(config)# enable secret <password>
switch(config)# username admin privilege 15 secret <password>
switch(config)# ip domain-name network.arista.com
switch(config)# management ssh
switch(config-mgmt-ssh)# idle-timeout 5
switch(config-mgmt-ssh)# no shutdown
switch(config)# management api http-commands
switch(config-mgmt-http-commands)# protocol https
switch(config-mgmt-http-commands)# no shutdown

Local accounts should use secret (hashed) rather than plain text, and the HTTPS eAPI server is enabled with management api http-commands for programmatic access. That one block turns the switch into something Ansible, Python or Terraform can drive over the /command-api endpoint without a screen-scraping framework. Disable unencrypted access while you are here:

switch(config)# no management telnet
switch(config)# management console
switch(config-mgmt-console)# idle-timeout 10
switch(config)# banner login
Enter text, end with EOF.

Time, DNS and AAA belong in the same change window - a switch with the wrong clock produces useless logs, and broken DNS makes every certificate error look like a bug:

switch(config)# ntp server 10.0.0.10
switch(config)# ip name-server 8.8.8.8
switch(config)# aaa authentication login default group tacacs+ local
switch(config)# aaa authorization exec default group tacacs+ local
switch(config)# aaa accounting exec default start-stop group tacacs+

Centralising authentication matters more on EOS than on a single legacy switch because AAA is what lets you grant read-only access to monitoring tools while keeping full privilege for the on-call engineer. Server groups, source interfaces and local fallback are all configured in a few lines under the same aaa hierarchy.

Interface and Port Basics

switch(config)# interface Ethernet1
switch(config-if-Et1)# description Uplink-to-spine1
switch(config-if-Et1)# no shutdown
switch(config-if-Et1)# mtu 9214
switch(config-if-Et1)# speed forced 25gfull
switch(config)# interface Ethernet3-4
switch(config-if-Et3-4)# shutdown

Data-center links normally run mtu 9214 for jumbo frames. Leave access ports at the default unless the entire path - switch port, transit hop, server NIC and storage target - is set the same, because a single non-jumbo hop is enough to break large frames silently. That mismatch is the classic cause of intermittent VXLAN and iSCSI symptoms that look like packet loss but are really fragmentation. Descriptions are not decoration either: on a 64-port leaf, show interfaces description is the fastest way to find a mis-cabled uplink.

VLAN and Switchport Commands

switch(config)# vlan 10
switch(config-vlan-10)# name wireless
switch(config-vlan-10)# state active
switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)# switchport access vlan 10

switch(config)# vlan 200
switch(config-vlan-200)# name voice
switch(config)# interface Ethernet2
switch(config-if-Et2)# switchport trunk native vlan 10
switch(config-if-Et2)# switchport phone vlan 200
switch(config-if-Et2)# switchport mode trunk phone

To suspend a VLAN without deleting it, enter vlan 10 then state suspend. The switchport mode trunk phone variant binds a voice VLAN to an IP phone while keeping the untagged data VLAN separate, so the phone tags its own traffic and honours the configured voice VLAN. When native VLAN mismatches reach production they usually surface as STP inconsistency or CDP/LLDP neighbour flapping rather than a clean outage; the EOS native VLAN and trunk troubleshooting guide walks through the diagnosis step by step.

Trunk and Port Channel Commands

switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# switchport mode trunk
switch(config-if-Et1/1)# switchport trunk native vlan 999
switch(config-if-Et1/1)# switchport trunk allowed vlan 10-12
switch(config)# interface port-channel 10
switch(config-if-Po10)# switchport mode trunk
switch(config)# interface Ethernet3-4
switch(config-if-Et3-4)# channel-group 10 mode active

An explicit allowed vlan list is a security control, not a formality - it prevents a newly created VLAN from being carried on every uplink by accident. Build the port-channel member list and the logical interface in either order, but always match the LACP mode on both ends: active prefers to speak, passive waits, and a one-sided active/passive pair still forms while two passive ends never will. Load-balance the members with port-channel load-balance when the default hash is not spreading traffic evenly across a four-member bundle.

Spanning Tree and Security Hardening

switch(config)# spanning-tree vlan 1,10 priority 4096
switch(config)# interface Ethernet1
switch(config-if-Et1)# spanning-tree portfast
switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping vlan 10
switch(config)# interface Ethernet5
switch(config-if-Et5)# ip dhcp snooping trust
switch(config)# ip arp inspection
switch(config)# ip arp inspection vlan 10

DHCP snooping builds the trust boundary (uplinks trusted, access ports untrusted) and Dynamic ARP Inspection (DAI) then validates ARP packets against the snooping database - the standard two-step protection against spoofing on access VLANs. Pair it with edge-port hardening so a rogue access point or desk switch cannot inject BPDUs:

switch(config-if-Et5)# spanning-tree bpduguard enable
switch(config-if-Et5)# spanning-tree guard loop
switch(config-if-Et5)# storm-control broadcast level 1
switch(config-if-Et5)# storm-control action trap

The complete roll-out order for PortFast, BPDU Guard and loop guard on access ports is covered in the EOS PortFast and BPDU Guard setup guide. Set the root bridge deliberately with priority rather than relying on MAC-address election, or the topology may re-converge around whichever switch booted last.

Routing Commands

switch(config)# ip routing
switch(config)# interface Vlan10
switch(config-if-Vlan10)# ip address 10.10.10.1/24
switch(config)# ip route 0.0.0.0/0 172.16.2.1
switch(config)# ip route 172.16.1.0/24 172.16.2.1 Ethernet1/1

EOS accepts CIDR notation directly (10.10.10.1/24), so you do not have to convert to a dotted mask. A static route can pin the next hop to an interface as well as an IP address, which is useful when the egress is ambiguous. For dynamic routing, router bgp and router ospf follow the same sub-mode pattern, and an SVI stays down until at least one port in its VLAN is up - the single most common "gateway does not answer" surprise on a fresh build.

Overlay and VXLAN Commands

switch(config)# interface Vxlan1
switch(config-if-Vx1)# vxlan source-interface Loopback0
switch(config-if-Vx1)# vxlan vlan 10 vni 1010
switch(config-if-Vx1)# vxlan flood vtep 10.255.0.2 10.255.0.3
switch(config-if-Vx1)# vxlan udp-port 4789

Keep the underlay MTU 50 bytes larger than the payload when you add the VXLAN header, and confirm both source and destination VTEP addresses are reachable in the underlay before expecting a single overlay mapping to forward a frame. A static flood list is fine for small fabrics; production leaf-spine normally learns remote VTEPs through BGP EVPN instead.

SNMP, Logging and Event Capture

switch(config)# snmp-server community public ro
switch(config)# snmp-server host 10.0.0.50 version 2c public
switch(config)# logging host 10.0.0.60
switch(config)# logging trap warnings
switch(config)# logging source-interface Loopback0
switch(config)# logging level SpanningTree warnings

Send logs to a central collector with an explicit source interface, otherwise every event arrives with whatever address the egress interface happens to have and correlation breaks. EOS lets you raise or lower the log level per subsystem, so you can crank spanning-tree and routing protocol logging during a change window without drowning in interface-up chatter.

Storm Control and QoS Basics

switch(config-if-Et1)# storm-control broadcast level 5
switch(config-if-Et1)# storm-control multicast level 5
switch(config-if-Et1)# storm-control unknown-unicast level 5
switch(config)# qos trust dscp
switch(config)# qos map cos 5 to dscp 46

Storm control drops the flood and, with action trap, raises an SNMP trap at the same time. On user-facing ports a 1-5 percent broadcast ceiling is usually generous; on fabric uplinks leave storm control off, because legitimate broadcast or unknown-unicast bursts during an EVPN convergence should not be clipped.

Monitoring and Show Commands

switch# show interfaces status
switch# show vlan
switch# show interfaces Ethernet1 | json
switch# show ip route
switch# show ip interface brief
switch# show lldp neighbors
switch# show spanning-tree vlan 10
switch# show logging

Two EOS habits speed up troubleshooting. First, most show commands accept a trailing | json or | include filter, so you can pipe output straight into a parser instead of regex-ing columns. Second, show version, show interfaces and show running-config all reflect live state - there is no separate "display" versus "show" dialect to remember.

Verifying and Saving Configuration

switch# show running-config
switch# copy running-config startup-config
switch# show boot-config
switch# reload

Check the boot-config before a reload to confirm which image and configuration will load, then save. Because the configuration is a plain file, you can also copy it to a TFTP or SCP server as an off-device backup and diff it later - the same approach the Arista EOS VLAN, trunk, SVI and port-channel runbook uses for staged changes. When first-boot provisioning repeats across dozens of leafs, the EOS Zero-Touch Provisioning guide automates the same command set with a boot script so nobody types the management block twice.

Quick Category Map

Pin this page, keep the runbooks above beside it, and the daily EOS edits - a new VLAN, a new trunk, a new SVI - become copy, paste, verify, save rather than recall under pressure.

原文链接：https://www.cisconetsolutions.com/arista-eos-configuration-cheat-sheet/