Arista EOS CLI Commands Cheat Sheet: VLAN, STP and Security

2026年9月2日 LOG admin

Arista EOS is a Linux-based network operating system used across data center, cloud and AI fabrics, and its CLI stays close to IOS-style syntax while adding Linux-friendly automation hooks such as eAPI and gNMI. This cheat sheet collects the EOS commands network engineers reach for most often - management access, VLAN and trunk configuration, spanning tree, security features and routing - with one-line examples for each task.

Management and Access Security

switch> enable
switch# configure terminal
switch(config)# hostname sw-leaf-01
switch(config)# enable secret <password>
switch(config)# username admin privilege 15 secret <password>
switch(config)# ip domain-name network.arista.com
switch(config)# management ssh
switch(config-mgmt-ssh)# idle-timeout 5
switch(config-mgmt-ssh)# no shutdown
switch(config)# management api http-commands
switch(config-mgmt-http-commands)# protocol https
switch(config-mgmt-http-commands)# no shutdown

Local accounts should use secret (hashed) rather than plain text, and the HTTPS eAPI server is enabled with management api http-commands for programmatic access.

VLAN and Switchport Commands

switch(config)# vlan 10
switch(config-vlan-10)# name wireless
switch(config-vlan-10)# state active
switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)# switchport access vlan 10

switch(config)# vlan 200
switch(config-vlan-200)# name voice
switch(config)# interface Ethernet2
switch(config-if-Et2)# switchport trunk native vlan 10
switch(config-if-Et2)# switchport phone vlan 200
switch(config-if-Et2)# switchport mode trunk phone

To suspend a VLAN without deleting it, enter vlan 10 then state suspend. The switchport mode trunk phone variant binds a voice VLAN to an IP phone while keeping the untagged data VLAN separate.

Trunk and Port Channel Commands

switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# switchport mode trunk
switch(config-if-Et1/1)# switchport trunk native vlan 999
switch(config-if-Et1/1)# switchport trunk allowed vlan 10-12
switch(config)# interface port-channel 10
switch(config-if-Po10)# switchport mode trunk
switch(config)# interface Ethernet3-4
switch(config-if-Et3-4)# channel-group 10 mode active

Spanning Tree and Security Hardening

switch(config)# spanning-tree vlan 1,10 priority 4096
switch(config)# interface Ethernet1
switch(config-if-Et1)# spanning-tree portfast
switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping vlan 10
switch(config)# interface Ethernet5
switch(config-if-Et5)# ip dhcp snooping trust
switch(config)# ip arp inspection
switch(config)# ip arp inspection vlan 10

DHCP snooping builds the trust boundary (uplinks trusted, access ports untrusted) and Dynamic ARP Inspection (DAI) then validates ARP packets against the snooping database - the standard two-step protection against spoofing on access VLANs.

Routing Commands

switch(config)# ip routing
switch(config)# interface Vlan10
switch(config-if-Vlan10)# ip address 10.10.10.1/24
switch(config)# ip route 0.0.0.0/0 172.16.2.1
switch(config)# ip route 172.16.1.0/24 172.16.2.1 Ethernet1/1