SW-CORE-01(config)# ip domain-name corporate.local\nSW-CORE-01(config)# crypto key generate rsa modulus 2048\n<\/code><\/pre>\nEnforce modern SSH Protocol Version 2:<\/p>\n
SW-CORE-01(config)# ip ssh version 2\nSW-CORE-01(config)# ip ssh time-out 60\nSW-CORE-01(config)# ip ssh authentication-retries 3\n<\/code><\/pre>\n<\/span>Step 2: Create a Local Administrator Account<\/span><\/h3>\nEstablish administrative credentials bound to the switch’s local database using scrypt or SHA-256 password hashing:<\/p>\n
SW-CORE-01(config)# username netadmin privilege 15 secret SuperAdminP@ssw0rd!\n<\/code><\/pre>\n<\/span>Step 3: Configure Virtual Terminal (VTY) Lines<\/span><\/h3>\nApply local authentication, lock transport protocols exclusively to SSH, and apply an inactivity timeout:<\/p>\n
SW-CORE-01(config)# line vty 0 15\nSW-CORE-01(config-line)# login local\nSW-CORE-01(config-line)# transport input ssh\nSW-CORE-01(config-line)# exec-timeout 10 0\nSW-CORE-01(config-line)# exit\n<\/code><\/pre>\n<\/span>Step 4: Secure the Physical Console Port<\/span><\/h3>\nExtend local credential enforcement to physical terminal sessions over the console cable:<\/p>\n
SW-CORE-01(config)# line con 0\nSW-CORE-01(config-line)# login local\nSW-CORE-01(config-line)# exec-timeout 5 0\nSW-CORE-01(config-line)# exit\n<\/code><\/pre>\n<\/span>Step 5: Encrypt Clear-Text Service Passwords<\/span><\/h3>\nEnsure plain-text strings generated by legacy commands are obfuscated within the configuration file:<\/p>\n
SW-CORE-01(config)# service password-encryption\n<\/code><\/pre>\n
\n<\/span>Traffic Segmentation: Configuring VLANs and 802.1Q Trunk Ports<\/span><\/h2>\nVirtual Local Area Networks (VLANs) segregate broadcast domains across Layer 2 environments, preventing unconstrained network chatter and establishing security boundaries between functional groups (e.g., users, servers, and voice systems).<\/p>\n
<\/span>Step 1: Create and Name Local VLANs<\/span><\/h3>\nDefine distinct VLAN IDs within the switch’s local database:<\/p>\n
SW-CORE-01(config)# vlan 10\nSW-CORE-01(config-vlan)# name DATA_USERS\nSW-CORE-01(config-vlan)# exit\n\nSW-CORE-01(config)# vlan 20\nSW-CORE-01(config-vlan)# name VOICE_DEVICES\nSW-CORE-01(config-vlan)# exit\n\nSW-CORE-01(config)# vlan 99\nSW-CORE-01(config-vlan)# name MANAGEMENT\nSW-CORE-01(config-vlan)# exit\n<\/code><\/pre>\n<\/span>Step 2: Configure Access Ports for Endpoints<\/span><\/h3>\nAssign network ports to access mode to service client devices, printers, and workstations:<\/p>\n
SW-CORE-01(config)# interface GigabitEthernet0\/1\nSW-CORE-01(config-if)# description User Workstation Endpoint\nSW-CORE-01(config-if)# switchport mode access\nSW-CORE-01(config-if)# switchport access vlan 10\nSW-CORE-01(config-if)# spanning-tree portfast\nSW-CORE-01(config-if)# spanning-tree bpduguard enable\nSW-CORE-01(config-if)# no shutdown\nSW-CORE-01(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 3: Configure Voice VLANs (Optional Multi-VLAN Access)<\/span><\/h3>\nWhen attaching a VoIP phone carrying an integrated PC pass-through port:<\/p>\n
SW-CORE-01(config)# interface GigabitEthernet0\/2\nSW-CORE-01(config-if)# switchport mode access\nSW-CORE-01(config-if)# switchport access vlan 10\nSW-CORE-01(config-if)# switchport voice vlan 20\nSW-CORE-01(config-if)# spanning-tree portfast\nSW-CORE-01(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 4: Configure 802.1Q Trunk Uplinks<\/span><\/h3>\nTrunk interfaces carry multi-VLAN traffic across switches and upstream firewalls or routers using IEEE 802.1Q tag encapsulation:<\/p>\n
SW-CORE-01(config)# interface GigabitEthernet0\/24\nSW-CORE-01(config-if)# description UPLINK_TO_DISTRIBUTION\n<\/code><\/pre>\n(On legacy Catalyst hardware that supports ISL, explicitly define encapsulation: switchport trunk encapsulation dot1q<\/code> before setting trunk mode).<\/em><\/p>\nSW-CORE-01(config-if)# switchport mode trunk\nSW-CORE-01(config-if)# switchport trunk native vlan 99\nSW-CORE-01(config-if)# switchport trunk allowed vlan 10,20,99\nSW-CORE-01(config-if)# no shutdown\nSW-CORE-01(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 5: Verify Layer 2 Operational State<\/span><\/h3>\nExecute verification checks from privileged EXEC mode:<\/p>\n
SW-CORE-01# show vlan brief\nSW-CORE-01# show interfaces trunk\nSW-CORE-01# show interfaces GigabitEthernet0\/1 switchport\n<\/code><\/pre>\n
\n<\/span>Cisco Switch Deployment Template and CLI Cheat Sheet<\/span><\/h2>\nUse the following modular template for rapid bare-metal provisioning across newly installed switches. Replace variable blocks marked with <ANGLE_BRACKETS><\/code> prior to executing commands in terminal sessions.<\/p>\n! ===================================================================\n! CISCO CATALYST BASELINE PROVISIONING TEMPLATE\n! ===================================================================\n\nconfigure terminal\n\n! --- Basic Identification & Services ---\nhostname <HOSTNAME>\nip domain-name <DOMAIN_NAME>\nno ip domain-lookup\nservice password-encryption\n\n! --- Local Security Credentials ---\nenable secret <PRIVILEGED_EXEC_PASSWORD>\nusername <ADMIN_USERNAME> privilege 15 secret <ADMIN_PASSWORD>\n\n! --- Cryptographic Setup & SSH Hardening ---\ncrypto key generate rsa modulus 2048\nip ssh version 2\nip ssh time-out 60\nip ssh authentication-retries 3\n\n! --- Management Interface Configuration ---\nvlan <MGMT_VLAN_ID>\n name MANAGEMENT\n exit\n\ninterface vlan <MGMT_VLAN_ID>\n description Management SVI\n ip address <MANAGEMENT_IP> <SUBNET_MASK>\n no shutdown\n exit\n\nip default-gateway <GATEWAY_IP>\n\n! --- Console & Remote Access Lines ---\nline con 0\n login local\n exec-timeout 5 0\n logging synchronous\n exit\n\nline vty 0 15\n login local\n transport input ssh\n exec-timeout 10 0\n logging synchronous\n exit\n\n! --- VLAN Creation ---\nvlan 10\n name CORPORATE_DATA\nvlan 20\n name VOIP_TELEPHONY\nvlan 30\n name GUEST_NETWORK\nexit\n\n! --- Standard Access Port Baseline ---\ninterface range GigabitEthernet0\/1 - 12\n switchport mode access\n switchport access vlan 10\n spanning-tree portfast\n spanning-tree bpduguard enable\n no shutdown\n exit\n\n! --- Uplink 802.1Q Trunk Port Baseline ---\ninterface GigabitEthernet0\/24\n description Core Uplink Trunk\n switchport mode trunk\n switchport trunk native vlan <MGMT_VLAN_ID>\n switchport trunk allowed vlan 10,20,30,<MGMT_VLAN_ID>\n no shutdown\n exit\n\n! --- Banner and Logging ---\nbanner motd ^C\n=======================================================================\n UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS STRICTLY PROHIBITED!\n Violators will be prosecuted to the fullest extent of civil\/criminal law.\n=======================================================================\n^C\n\nend\nwrite memory\n<\/code><\/pre>\n
\n<\/span>Cisco Catalyst Software Documentation and Technical Reference Manuals<\/span><\/h2>\nOfficial Cisco documentation provides authoritative command syntax, software version release limits, and architectural compatibility guidelines across IOS and IOS-XE platforms.<\/p>\n
<\/span>Documentation Categories and Functional Scopes<\/span><\/h3>\n\n- Software Configuration Guides:<\/strong> Feature-centric manuals detailing protocol theory, operational limits, default configurations, and prerequisites for specific operating system releases (e.g., Cisco IOS XE Cupertino 17.9.x Layer 2 Configuration Guide<\/em>).<\/li>\n
- Command Reference Guides:<\/strong> Syntax dictionaries structured alphabetically by command name. These provide exact parameter descriptions, valid input ranges, command modes, and associated output field explanations.<\/li>\n
- Release Notes:<\/strong> Hardware- and software-specific bulletins outlining supported platforms, ROMMON version requirements, deprecated features, open bugs, and resolved caveats across specific maintenance releases.<\/li>\n
- Hardware Installation Guides (HIG):<\/strong> Physical infrastructure specifications detailing chassis airflow, thermal output, power supply requirements, rack-mounting mechanics, and front-panel LED indicators.<\/li>\n<\/ul>\n
<\/span>Cisco Technical Support Navigation Pathways<\/span><\/h3>\n