Configure the router.
Verify the path.

Establish a safe baseline

Set a meaningful hostname and IP domain name, protect privileged EXEC access with enable secret, create a local username with a secret, and secure console and VTY access. For SSH, generate RSA keys after setting the hostname/domain name, configure VTY lines with login local, and restrict transport input to SSH. Use a legal message-of-the-day banner. The legacy service password-encryption command applies reversible Type 7 obfuscation to certain plaintext line passwords; it is not strong modern encryption and does not replace enable secret or SSH. Test a login banner by opening a new session, not by rebooting the router.

Configure routed interfaces

Enter interface configuration mode for each required router interface. Apply the IPv4 address and subnet mask from the topology/addressing table, add a useful description, and issue no shutdown when the interface should be enabled. Configure both LAN/WAN-facing interfaces as required; do not copy an address or mask from the wrong subnet. A router interface must be correctly addressed and operational before it can route traffic for that network.

Configure and verify routing

Hosts use the router interface on their own subnet as the default gateway. A Layer 2 switch can use ip default-gateway for management traffic sent to other IP networks; this is not a routed default route for user VLAN traffic. Routers need routes to remote networks, which may be directly connected, statically configured, or learned through a routing protocol. Use show ip interface brief, show ip route, and ping to verify interface and path state.

Interpret interface states and verify faults

In a brief interface summary, up/up means the physical interface and line protocol are operational. Administratively down/down means the interface is shut down in configuration. Up/down means the physical layer is up but the line protocol is down; check the far end, encapsulation, keepalives, and counters. A status summary is a starting point, not a complete diagnosis. Use show interfaces and the relevant IPv4/IPv6 interface commands for detail.

Apply and test a secure baseline

A typical initial sequence is to set hostname and domain name, configure enable secret and a local username secret, secure the console line, generate RSA keys, configure VTY local authentication and SSH-only transport, set a legal banner, and save the running configuration with copy running-config startup-config. Saving does not reload the router or change the active running configuration. If changes are not saved, a reboot or power loss can discard them. Open a new management session to verify the banner and SSH access.

hostname R1
ip domain-name example.local
enable secret <strong-secret>
username admin secret <user-secret>
crypto key generate rsa
line console 0
 login local
line vty 0 4
 login local
 transport input ssh
banner motd ^CAuthorized access only.^C
service password-encryption
copy running-config startup-config

Command availability and VTY line ranges vary by IOS platform. Verify the actual device before applying a template.