Arista EOS Configuration Cheat Sheet: Essential CLI Commands

Arista EOS is a Linux-based network operating system built around programmability, automation and high availability, and its CLI is deliberately modeled on Cisco IOS so network engineers can migrate quickly. This cheat sheet collects the essential EOS configuration commands in one place: system and management setup, VLANs and trunks, port-channels, spanning tree, routing protocols, ACLs, SNMP and monitoring - each with a minimal working example.

Everything below is copy-pasteable. Where a command has a Cisco equivalent the syntax is close but never identical — EOS drops DTP, VTP and HSRP entirely and replaces them with explicit trunks, explicit VLANs and VRRP. Read the whole sheet once before you use a line in production, because a few defaults (native VLAN, STP mode, interface naming) differ from IOS in ways that bite during a migration.

Before You Start: Modes, Prompts and Habits

EOS has the same three-tier mode structure you already know. The prompt tells you exactly where you are, which matters because EOS will happily accept a command in the wrong submode and reject it with an error rather than guessing.

switch> enable                     # user EXEC  -> privileged EXEC
switch# configure terminal         # privileged EXEC -> global config
switch(config)# interface Ethernet1   # global config -> interface config
switch(config-if-Et1)# exit        # back one level
switch(config)# end                # straight back to privileged EXEC

Three habits make EOS sessions faster and safer:

• terminal length 0 disables paging so a long show command completes in one screen — essential for scripting and for SSH sessions over slow links.
• show running-config diffs shows what changed since the last saved configuration, which is the fastest way to review your own edit before writing it to flash.
• write memory (or copy running-config startup-config) commits the change. EOS does not auto-save, so a reload without it loses everything.

Basic System Configuration

switch> enable
switch# configure terminal
switch(config)# hostname switch-1
switch(config)# enable secret <password>
switch(config)# username admin privilege 15 secret <password>
switch(config)# ip domain-name network.arista.com
switch(config)# management ssh idle-timeout 5 no shutdown

Add a management path and a clock source immediately after the hostname — almost every later troubleshooting step depends on accurate timestamps and a reachable management address:

switch(config)# interface Management1
switch(config-if-Ma1)# ip address 10.0.0.10/24
switch(config-if-Ma1)# no shutdown
switch(config)# ip route 0.0.0.0/0 10.0.0.1
switch(config)# ntp server 10.0.0.1
switch(config)# clock timezone UTC

VLAN and Interface Configuration

switch(config)# vlan 10 name wireless
switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)# switchport access vlan 10

! trunk with non-default native VLAN
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# switchport mode trunk
switch(config-if-Et1/1)# switchport trunk native vlan 999
switch(config-if-Et1/1)# switchport trunk allowed vlan 10-12

! LACP port-channel
switch(config)# interface Ethernet 1-2
switch(config-if-Et1-2)# channel-group 1 mode active
switch(config)# interface port-channel 1
switch(config-if-Po1)# switchport mode trunk
switch(config-if-Po1)# switchport trunk allowed vlan 10-12

! SVI
switch(config)# interface vlan 10
switch(config-if-Vl10)# ip address 172.16.1.1/24
switch(config-if-Vl10)# no shutdown

EOS VLANs are explicit: you create the VLAN, then you assign ports. There is no VTP-style propagation, so a VLAN that is missing on one switch in a trunk path simply drops traffic for that VLAN. When you build a trunk, always set the native VLAN explicitly and prune the allowed list — the default switchport trunk allowed vlan all leaks every VLAN you create later, including ones that should never leave the rack.

Useful verification for this section:

switch# show vlan
switch# show interfaces Ethernet1/1 switchport
switch# show interfaces trunk
switch# show vlan 10

Spanning Tree and Port Security

switch(config)# spanning-tree mode rapid-pvst
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# switchport mode access
switch(config-if-Et1/1)# spanning-tree portfast
switch(config-if-Et1/1)# spanning-tree bpduguard enable
switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport port-security
switch(config-if-Et1)# switchport port-security maximum 1

EOS supports STP, RSTP, MSTP and Rapid-PVST; Rapid-PVST is the default on most platforms and interoperates cleanly with Cisco. Access ports that face hosts should always carry both spanning-tree portfast and spanning-tree bpduguard enable — the first removes the 30-second listening/learning delay, the second err-disables the port if someone plugs in another switch and starts leaking BPDUs. Port security pairs naturally with it: cap the MAC count, and consider adding switchport port-security violation restrict plus a sticky address so the port survives a single re-cabled device.

Routing Configuration

! static routes
switch(config)# ip route 172.16.1.0/24 172.16.2.1
switch(config)# ip route 0.0.0.0/0 172.33.1.2

! OSPF
switch(config)# router ospf 1
switch(config-router-ospf)# router-id 172.16.255.1
switch(config-router-ospf)# network 192.168.0.0/16 area 0

! eBGP
switch(config)# router bgp 65001
switch(config-router-bgp)# neighbor 192.168.1.2 remote-as 65000
switch(config-router-bgp)# network 192.168.1.0/24

Layer 3 is off by default — add ip routing in global config before any SVI will forward between subnets. Also note that OSPF in EOS keeps the IOS-style network statement with a wildcard-free CIDR mask, and that interface-level OSPF is available too:

switch(config)# ip routing
switch(config)# router ospf 1
switch(config-router-ospf)# router-id 172.16.255.1
switch(config-router-ospf)# network 10.0.0.0/30 area 0
switch(config-router-ospf)# passive-interface default
switch(config-router-ospf)# no passive-interface Ethernet1/1

For BGP, add an address family when you need per-neighbor policy, and remember that EOS will not originate a prefix unless it is in the routing table:

switch(config)# router bgp 65001
switch(config-router-bgp)# router-id 172.16.255.1
switch(config-router-bgp)# neighbor 192.168.1.2 remote-as 65000
switch(config-router-bgp)# neighbor 192.168.1.2 send-community
switch(config-router-bgp)# neighbor 192.168.1.2 maximum-routes 12000
switch(config-router-bgp)# redistribute connected

ACL Configuration

switch(config)# ip access-list extended HTTPS-FILTER
switch(config-acl-HTTPS-FILTER)# permit tcp 192.168.1.0/24 any eq 443
switch(config-acl-HTTPS-FILTER)# deny tcp 192.168.1.0/24 any eq 23
switch(config-acl-HTTPS-FILTER)# permit ip any any
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# ip access-group HTTPS-FILTER in

EOS uses named ACLs and CIDR masks throughout, so 192.168.1.0/24 replaces the IOS 192.168.1.0 0.0.0.255 form. Apply with ip access-group for routed traffic and mac access-group for Layer 2 filtering; there is no implicit permit unless you add one, and a deny at the end of an interface ACL drops everything you did not explicitly allow.

Management and Monitoring

switch(config)# snmp-server community arista ro
switch(config)# snmp-server group <group> v3 priv
switch(config)# logging host 192.168.3.1
switch(config)# ntp server 172.16.1.1 prefer
switch(config)# aaa authentication login default group tacacs+ local

Send logs to a collector with a defined severity and a source interface so events are easy to attribute later, and always keep a local fallback first or last in the AAA list:

switch(config)# logging source-interface Management1
switch(config)# logging trap informational
switch(config)# logging level ACL info
switch(config)# tacacs-server host 10.0.0.5
switch(config)# tacacs-server key 7 <encrypted-key>
switch(config)# aaa authentication login default group tacacs+ local

Automation-Friendly Output and Verification

The reason network engineers move to EOS is the same reason the CLI is worth learning properly: every show command can emit structured output, and the underlying Linux shell is one command away.

switch# show version
switch# show running-config
switch# show running-config diffs
switch# show interfaces status
switch# show ip interface brief
switch# show interfaces Ethernet1 json
switch# show vlan | json
switch# show lldp neighbors detail
switch# bash
switch# show management api http-commands

show ... | json produces machine-readable output that Ansible, Python or a CI pipeline can parse without screens, and bash drops you into the Linux shell where show running-config is just the configuration of a tool called FastCli. Combining the two is what makes templated rollouts safe: render configuration, push it, then validate with JSON output rather than grep.

Monitoring, Mirroring and Link Health

Two more commands belong in any EOS cheat sheet because they come up during every incident: LLDP for topology discovery and a local mirror session family for packet capture without a TAP.

switch(config)# lldp run
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# no lldp transmit

! SPAN session: copy traffic from one port to a capture port
switch(config)# monitor session cap1 source Ethernet1/1 both
switch(config)# monitor session cap1 destination Ethernet2

switch# show lldp neighbors
switch# show monitor session cap1
switch# show interfaces Ethernet1/1 counters errors

Mirror sessions are named, can have several sources, and can also select a VLAN or a port-channel as the source. Keep the destination port out of production VLANs — it becomes a one-way capture port while the session exists. For link health, show interfaces counters errors and show interfaces counters rates tell you in seconds whether a reported problem is a physical layer issue or a configuration one.

EOS Configuration Notes

• Interface naming uses Ethernet (Et1, Et49) without speed.
• CIDR format (/24) is used for addressing, SVIs and routing protocols.
• EOS supports STP, RSTP, MSTP and PVRST; VRRP replaces HSRP.
• No DTP, no VTP - trunks and VLANs are configured explicitly.
• Verify trunking with show interfaces switchport.
• Use show running-config include hostname and show interfaces json for automation-friendly output.

Common Mistakes and Quick Fixes

• Traffic disappears on a new VLAN. The VLAN was created on one switch but not the other, or the trunk's allowed list does not include it. Check show interfaces trunk on both ends.
• SVI stays down. The VLAN does not exist, or no port is a member of it. Create the VLAN or add an access port first.
• Port-channel does not come up. One side is configured with a mismatched mode (active versus on) or a different allowed VLAN list. LACP needs the member interfaces to be identical on both ends.
• BPDU guard disabled a port. Someone connected a switch to an access port. show interfaces Ethernet1/1 shows the err-disabled reason; fix the topology, then shutdown / no shutdown to recover.
• Management SSH refuses connections. Confirm the management interface is up, the default route exists on the management VRF and management ssh is not administratively shut.
• SSH password works, TACACS+ does not. The AAA list falls back to local, which hides a broken key or unreachable server. Test with test aaa and check the source interface.

FAQ

How close is EOS syntax to Cisco IOS? Close enough that muscle memory works for interfaces, VLANs, routing and ACLs, but not identical: CIDR everywhere, no DTP/VTP, VRRP instead of HSRP, and different interface naming.

Can I load an IOS configuration directly? No. Most lines translate cleanly, but the shortcut commands (switchport trunk encapsulation dot1q, no ip domain-lookup, DTP settings) do not exist and will be rejected with a syntax error.

Where do I save the configuration? write memory. EOS also supports rollback to a previous saved configuration, which is worth testing before a large change.

Is there a single command to review my change? show running-config diffs after editing, before write memory.

Related articles: How to manage VLANs on Arista EOS, SONiC CLI cheat sheet, and Port mirroring on Cisco, Huawei and Arista. For command-mode details and aliases see Arista EOS CLI command modes, for the IOS-by-IOS translation table see Cisco IOS to Arista EOS command mapping, and for templated rollouts see Ansible Jinja2 templates for network device configs.

原文链接：https://www.cisconetsolutions.com/arista-eos-configuration-cheat-sheet/