CCNA 200-301

CCNP Enterprise

CCNP Security

CCIE Enterprise Lab

CCIE Security Lab

CCNP Service Provider

CCNP Data Center

CCNP Collaboration

CCIE DC Lab

Cisco Catalyst switches represent the primary switching fabric in enterprise, campus, and small business architectures worldwide. Deploying a Cisco switch requires establishing baseline administrative controls, segmenting local traffic through virtual local area networks (VLANs), and securing CLI access paths against unauthorized entry. Whether provisioning brand-new hardware out of the box or reprovisioning an existing unit, following a standardized configuration methodology ensures network reliability, security compliance, and predictable traffic forwarding.

This guide outlines the end-to-end process of Cisco switch configuration, detailing hardware preparation, foundational setup, access hardening, Layer 2 segmentation, production deployment scripting, and navigation of official Cisco reference documentation.

Factory Resetting and Administrative Password Recovery

When deploying pre-owned switches or reallocating hardware across environments, wiping residual configurations ensures that legacy access-lists, stale VLAN topologies, and outdated IP assignments do not disrupt the network.

Standard Factory Reset Procedure

To restore a switch that you can currently log into with administrative privileges:

  1. Enter Privileged EXEC Mode
    text
    Switch> enable

  2. Erase the Startup Configuration
    Wipe the configuration stored in Non-Volatile RAM (NVRAM):
    text
    Switch# write erase
    Alternative command: erase startup-config. Confirm when prompted by pressing Enter.

  3. Delete Existing VLAN Databases
    Catalyst switches store VLAN configurations in a separate file on flash memory rather than in the startup configuration:
    text
    Switch# delete flash:vlan.dat
    Confirm file deletion when prompted.

  4. Reload the Switch
    Restart the hardware to boot with zeroed settings:
    text
    Switch# reload
    If prompted to save current changes, enter no. Confirm reload to complete the reset.

ROMMON Password Recovery Procedure

If administrative credentials are unknown or lost, bypass the startup configuration using the switch ROM monitor (ROMMON):

  1. Interrupt the Normal Boot Process
  2. Connect an RJ45 console cable or USB-to-serial adapter from your workstation to the switch’s console port.
  3. Power off the switch by disconnecting the power cord.
  4. Reconnect power while pressing and holding the Mode button on the switch’s front panel.

  5. Release the button when the SYST LED blinks amber, then turns solid green (usually 10 to 15 seconds). The prompt displays switch:.

  6. Initialize Flash Storage and Bypass Stored Config
    Initialize the flash file system:
    text
    switch: flash_init
    Rename the existing configuration file to prevent the switch from loading it on boot:
    text
    switch: rename flash:config.text flash:config.old

  7. Boot into the Base System
    text
    switch: boot
    When asked to enter the initial configuration dialog during startup, enter no.

  8. Restore Configuration and Reset Credentials
    Enter privileged mode and restore the original configuration file back to running memory:
    text
    Switch> enable
    Switch# copy flash:config.old system:running-config
    Enter global configuration mode to set a new administrative secret:
    text
    Switch# configure terminal
    Switch(config)# enable secret <NEW_SECURE_PASSWORD>

  9. Re-enable Startup Auto-load and Save
    Rename the backup file back to its standard filename and commit changes:
    text
    Switch(config)# exit
    Switch# rename flash:config.old flash:config.text
    Switch# copy running-config startup-config

Step-by-Step Initial Cisco Switch Configuration

Once hardware is reset or unboxed, apply baseline system attributes. This establishes device identification, local network reachability, and management connectivity.

Step 1: Enter Configuration Mode

From the CLI prompt, navigate from user EXEC to global configuration mode:

Switch> enable
Switch# configure terminal
Switch(config)#

Step 2: Configure System Hostname and Disable DNS Lookup

Assign a distinct name to identify the switch within network topologies, and disable broadcast DNS queries triggered by CLI typographical errors:

Switch(config)# hostname SW-CORE-01
SW-CORE-01(config)# no ip domain-lookup

Step 3: Establish an Enable Secret Password

Protect access to privileged EXEC mode using modern hashing algorithms rather than legacy reversible ciphers:

SW-CORE-01(config)# enable secret StrongManagementPass123!

Step 4: Configure a Management SVI (Switch Virtual Interface)

Layer 2 switches require an SVI assigned to a designated management VLAN to enable IP communication:

SW-CORE-01(config)# interface vlan 1
SW-CORE-01(config-if)# description In-Band Management SVI
SW-CORE-01(config-if)# ip address 192.168.10.10 255.255.255.0
SW-CORE-01(config-if)# no shutdown
SW-CORE-01(config-if)# exit

Step 5: Assign the Default Gateway

For traffic to route beyond the local subnet (e.g., reaching a remote central management workstation or monitoring platform), define the upstream gateway IP:

SW-CORE-01(config)# ip default-gateway 192.168.10.1

Step 6: Configure Synchronous Logging

Prevent log notifications from interrupting command typing within the CLI:

SW-CORE-01(config)# line con 0
SW-CORE-01(config-line)# logging synchronous
SW-CORE-01(config-line)# exit

Step 7: Save Running Configuration to NVRAM

Changes made in Cisco IOS run strictly in volatile RAM until committed:

SW-CORE-01(config)# exit
SW-CORE-01# copy running-config startup-config

Note: The shorthand command write memory or wr produces the same operational outcome.

Securing Management Access: Console and SSH Configuration

Unencrypted Telnet transmits credentials in plain text across local broadcast domains. Administrative management lines must be locked down to cryptographic SSHv2 alongside strictly defined local authentication.

Step 1: Define Domain Name and Generate RSA Cryptographic Keys

SSH requires a fully qualified domain name (FQDN) component to construct the cryptographic host key pair:

SW-CORE-01(config)# ip domain-name corporate.local
SW-CORE-01(config)# crypto key generate rsa modulus 2048

Enforce modern SSH Protocol Version 2:

SW-CORE-01(config)# ip ssh version 2
SW-CORE-01(config)# ip ssh time-out 60
SW-CORE-01(config)# ip ssh authentication-retries 3

Step 2: Create a Local Administrator Account

Establish administrative credentials bound to the switch’s local database using scrypt or SHA-256 password hashing:

SW-CORE-01(config)# username netadmin privilege 15 secret SuperAdminP@ssw0rd!

Step 3: Configure Virtual Terminal (VTY) Lines

Apply local authentication, lock transport protocols exclusively to SSH, and apply an inactivity timeout:

SW-CORE-01(config)# line vty 0 15
SW-CORE-01(config-line)# login local
SW-CORE-01(config-line)# transport input ssh
SW-CORE-01(config-line)# exec-timeout 10 0
SW-CORE-01(config-line)# exit

Step 4: Secure the Physical Console Port

Extend local credential enforcement to physical terminal sessions over the console cable:

SW-CORE-01(config)# line con 0
SW-CORE-01(config-line)# login local
SW-CORE-01(config-line)# exec-timeout 5 0
SW-CORE-01(config-line)# exit

Step 5: Encrypt Clear-Text Service Passwords

Ensure plain-text strings generated by legacy commands are obfuscated within the configuration file:

SW-CORE-01(config)# service password-encryption

Traffic Segmentation: Configuring VLANs and 802.1Q Trunk Ports

Virtual Local Area Networks (VLANs) segregate broadcast domains across Layer 2 environments, preventing unconstrained network chatter and establishing security boundaries between functional groups (e.g., users, servers, and voice systems).

Step 1: Create and Name Local VLANs

Define distinct VLAN IDs within the switch’s local database:

SW-CORE-01(config)# vlan 10
SW-CORE-01(config-vlan)# name DATA_USERS
SW-CORE-01(config-vlan)# exit

SW-CORE-01(config)# vlan 20
SW-CORE-01(config-vlan)# name VOICE_DEVICES
SW-CORE-01(config-vlan)# exit

SW-CORE-01(config)# vlan 99
SW-CORE-01(config-vlan)# name MANAGEMENT
SW-CORE-01(config-vlan)# exit

Step 2: Configure Access Ports for Endpoints

Assign network ports to access mode to service client devices, printers, and workstations:

SW-CORE-01(config)# interface GigabitEthernet0/1
SW-CORE-01(config-if)# description User Workstation Endpoint
SW-CORE-01(config-if)# switchport mode access
SW-CORE-01(config-if)# switchport access vlan 10
SW-CORE-01(config-if)# spanning-tree portfast
SW-CORE-01(config-if)# spanning-tree bpduguard enable
SW-CORE-01(config-if)# no shutdown
SW-CORE-01(config-if)# exit

Step 3: Configure Voice VLANs (Optional Multi-VLAN Access)

When attaching a VoIP phone carrying an integrated PC pass-through port:

SW-CORE-01(config)# interface GigabitEthernet0/2
SW-CORE-01(config-if)# switchport mode access
SW-CORE-01(config-if)# switchport access vlan 10
SW-CORE-01(config-if)# switchport voice vlan 20
SW-CORE-01(config-if)# spanning-tree portfast
SW-CORE-01(config-if)# exit

Step 4: Configure 802.1Q Trunk Uplinks

Trunk interfaces carry multi-VLAN traffic across switches and upstream firewalls or routers using IEEE 802.1Q tag encapsulation:

SW-CORE-01(config)# interface GigabitEthernet0/24
SW-CORE-01(config-if)# description UPLINK_TO_DISTRIBUTION

(On legacy Catalyst hardware that supports ISL, explicitly define encapsulation: switchport trunk encapsulation dot1q before setting trunk mode).

SW-CORE-01(config-if)# switchport mode trunk
SW-CORE-01(config-if)# switchport trunk native vlan 99
SW-CORE-01(config-if)# switchport trunk allowed vlan 10,20,99
SW-CORE-01(config-if)# no shutdown
SW-CORE-01(config-if)# exit

Step 5: Verify Layer 2 Operational State

Execute verification checks from privileged EXEC mode:

SW-CORE-01# show vlan brief
SW-CORE-01# show interfaces trunk
SW-CORE-01# show interfaces GigabitEthernet0/1 switchport

Cisco Switch Deployment Template and CLI Cheat Sheet

Use the following modular template for rapid bare-metal provisioning across newly installed switches. Replace variable blocks marked with <ANGLE_BRACKETS> prior to executing commands in terminal sessions.

! ===================================================================
! CISCO CATALYST BASELINE PROVISIONING TEMPLATE
! ===================================================================

configure terminal

! --- Basic Identification & Services ---
hostname <HOSTNAME>
ip domain-name <DOMAIN_NAME>
no ip domain-lookup
service password-encryption

! --- Local Security Credentials ---
enable secret <PRIVILEGED_EXEC_PASSWORD>
username <ADMIN_USERNAME> privilege 15 secret <ADMIN_PASSWORD>

! --- Cryptographic Setup & SSH Hardening ---
crypto key generate rsa modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3

! --- Management Interface Configuration ---
vlan <MGMT_VLAN_ID>
 name MANAGEMENT
 exit

interface vlan <MGMT_VLAN_ID>
 description Management SVI
 ip address <MANAGEMENT_IP> <SUBNET_MASK>
 no shutdown
 exit

ip default-gateway <GATEWAY_IP>

! --- Console & Remote Access Lines ---
line con 0
 login local
 exec-timeout 5 0
 logging synchronous
 exit

line vty 0 15
 login local
 transport input ssh
 exec-timeout 10 0
 logging synchronous
 exit

! --- VLAN Creation ---
vlan 10
 name CORPORATE_DATA
vlan 20
 name VOIP_TELEPHONY
vlan 30
 name GUEST_NETWORK
exit

! --- Standard Access Port Baseline ---
interface range GigabitEthernet0/1 - 12
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
 exit

! --- Uplink 802.1Q Trunk Port Baseline ---
interface GigabitEthernet0/24
 description Core Uplink Trunk
 switchport mode trunk
 switchport trunk native vlan <MGMT_VLAN_ID>
 switchport trunk allowed vlan 10,20,30,<MGMT_VLAN_ID>
 no shutdown
 exit

! --- Banner and Logging ---
banner motd ^C
=======================================================================
 UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS STRICTLY PROHIBITED!
 Violators will be prosecuted to the fullest extent of civil/criminal law.
=======================================================================
^C

end
write memory

Cisco Catalyst Software Documentation and Technical Reference Manuals

Official Cisco documentation provides authoritative command syntax, software version release limits, and architectural compatibility guidelines across IOS and IOS-XE platforms.

Documentation Categories and Functional Scopes

  • Software Configuration Guides: Feature-centric manuals detailing protocol theory, operational limits, default configurations, and prerequisites for specific operating system releases (e.g., Cisco IOS XE Cupertino 17.9.x Layer 2 Configuration Guide).
  • Command Reference Guides: Syntax dictionaries structured alphabetically by command name. These provide exact parameter descriptions, valid input ranges, command modes, and associated output field explanations.
  • Release Notes: Hardware- and software-specific bulletins outlining supported platforms, ROMMON version requirements, deprecated features, open bugs, and resolved caveats across specific maintenance releases.
  • Hardware Installation Guides (HIG): Physical infrastructure specifications detailing chassis airflow, thermal output, power supply requirements, rack-mounting mechanics, and front-panel LED indicators.

Cisco Technical Support Navigation Pathways

Official manuals are hosted within the technical documentation architecture on the Cisco Support & Downloads portal (cisco.com/go/support):

  1. Catalyst 9000 Series (IOS-XE Enterprise Switching):
  2. Navigate: Products → Switches → Campus LAN Switches - Access → Catalyst 9200 / 9300 Series Switches → Configuration Guides.
  3. Core Focus: StackWise architecture, 802.1AE MACsec, NetFlow, and high-density 802.3bt PoE provisioning.
  4. Catalyst 1000 / 2960 Series (IOS SMB & Branch Switching):
  5. Navigate: Products → Switches → Campus LAN Switches - Access → Catalyst 1000 / 2960-X Series Switches → Reference Guides.
  6. Core Focus: Layer 2 baseline operations, standard spanning-tree parameterization, and localized hardware telemetry.
  7. Cisco Command Lookup Tool:
  8. Accessible via Cisco Support tools (requires an active Cisco Connection Online [CCO] account login), allowing administrators to verify CLI syntax, minimum supported IOS versions, and alternative command forms.

A structured deployment process—combining clean-slate hardware resets, robust management credentials, encrypted transport lines, and distinct Layer 2 segmentations—guarantees operational stability across enterprise switching environments. Using tested configuration templates and referencing Cisco’s official IOS-XE manuals helps maintain consistency across large networks and minimizes deployment errors.

Please follow and like us:
Tweet
fb-share-icon
Last modified: November 3, 2026

Author

Comments

Write a Reply or Comment

Your email address will not be published.