Switch(config)# interface vlan 10\nSwitch(config-if)# ip address 192.168.10.2 255.255.255.0\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\nEnsure the associated VLAN exists in the VLAN database and that at least one physical port assigned to that VLAN is active (up\/up<\/code>) or carrying the VLAN over an 802.1Q trunk.<\/p>\n<\/span>Step 3: Define the Default Gateway<\/span><\/h3>\nFrom global configuration mode, enter the ip default-gateway<\/code> command followed by the IP address of the upstream router or multilayer core switch interface serving that subnet:<\/p>\nSwitch(config)# ip default-gateway 192.168.10.1\n<\/code><\/pre>\nNote: The gateway IP address must reside in the exact same subnet as the management interface configured in Step 2.<\/em><\/p>\n<\/span>Step 4: Verify and Save the Configuration<\/span><\/h3>\nExit configuration mode and commit the changes from volatile RAM to non-volatile storage:<\/p>\n
Switch(config)# end\nSwitch# copy running-config startup-config\nDestination filename [startup-config]? [Enter]\nBuilding configuration...\n[OK]\n<\/code><\/pre>\n
\n<\/span>Configuring a Default Gateway on a Layer 3 Switch with IP Routing<\/span><\/h2>\nWhen deploying multilayer switches (such as Cisco Catalyst 3650, 3850, 9200, or 9300 series) with ip routing<\/code> enabled, the switch maintains its own routing table and forwards traffic between VLANs. In this operational mode, Cisco IOS completely ignores the ip default-gateway<\/code> command<\/strong>.<\/p>\nInstead, the switch requires a static default route\u2014also known as the Gateway of Last Resort\u2014to forward traffic destined for external networks.<\/p>\n
Follow these steps to establish a default route on a Layer 3 switch:<\/p>\n
<\/span>Step 1: Verify That IP Routing Is Enabled<\/span><\/h3>\nAccess global configuration mode and ensure the routing engine is active:<\/p>\n
Switch# configure terminal\nSwitch(config)# ip routing\n<\/code><\/pre>\nIf ip routing<\/code> was already enabled, the command will simply be accepted without error.<\/p>\n<\/span>Step 2: Configure a Static Default Route<\/span><\/h3>\nSpecify a default route using the 0.0.0.0 0.0.0.0<\/code> prefix and wildcard, pointing to the next-hop IP address of the upstream firewall or core router:<\/p>\nSwitch(config)# ip route 0.0.0.0 0.0.0.0 192.168.10.1\n<\/code><\/pre>\nIn this syntax:
\n– 0.0.0.0<\/code>: Represents any destination network.
\n– 0.0.0.0<\/code>: Represents any subnet mask (a quad-zero match).
\n– 192.168.10.1<\/code>: Specifies the next-hop IP address reachable via a local SVI or routed interface.<\/p>\n<\/span>Step 3: Remove Any Legacy ip default-gateway<\/code> Commands<\/span><\/h3>\nIf the switch was previously operating as a Layer 2 switch, clean up residual commands to avoid administrative confusion:<\/p>\n
Switch(config)# no ip default-gateway 192.168.10.1\n<\/code><\/pre>\n<\/span>Step 4: Validate the Gateway of Last Resort and Save<\/span><\/h3>\nReturn to privileged EXEC mode and confirm that the routing engine has installed the route:<\/p>\n
Switch(config)# end\nSwitch# show ip route | include Gateway of last resort\nGateway of last resort is 192.168.10.1 to network 0.0.0.0\nSwitch# write memory\n<\/code><\/pre>\n
\n<\/span>Technical Comparison: ip default-gateway<\/code> vs. ip route 0.0.0.0 0.0.0.0<\/code><\/span><\/h2>\nNetwork engineers frequently encounter scenarios where remote connectivity drops after enabling IP routing. The table below illustrates the operational differences between both commands:<\/p>\n
\n\n\n| Evaluation Criteria<\/th>\n | ip default-gateway<\/code><\/th>\nip route 0.0.0.0 0.0.0.0<\/code><\/th>\n<\/tr>\n<\/thead>\n\n\nPrimary Operational Purpose<\/strong><\/td>\n| Directs management plane traffic originated by the switch itself.<\/td>\n | Routes data plane and management traffic across subnets.<\/td>\n<\/tr>\n | \nOperating Switch Mode<\/strong><\/td>\nLayer 2 mode (no ip routing<\/code> active).<\/td>\nLayer 3 routing mode (ip routing<\/code> active).<\/td>\n<\/tr>\n\nRouting Table Interaction<\/strong><\/td>\n| Does not interact with or populate the IP routing table (RIB\/FIB).<\/td>\n | Installs a Gateway of Last Resort (S* 0.0.0.0\/0<\/code>) in the RIB\/FIB.<\/td>\n<\/tr>\n\nTransit Traffic Forwarding<\/strong><\/td>\n| Incapable of forwarding transit traffic between multiple VLANs.<\/td>\n | Forwards transit traffic between client VLANs and upstream networks.<\/td>\n<\/tr>\n | \nCommand Syntax<\/strong><\/td>\nip default-gateway <next-hop-ip><\/code><\/td>\nip route 0.0.0.0 0.0.0.0 <next-hop-ip> [metric]<\/code><\/td>\n<\/tr>\n\nBehavior When ip routing<\/code> Is Active<\/strong><\/td>\nIgnored.<\/strong> Command remains in running-config but is inactive.<\/td>\nActive.<\/strong> Used by Cisco Express Forwarding (CEF) for all unlisted routes.<\/td>\n<\/tr>\n\nTypical Target Platforms<\/strong><\/td>\n| Catalyst 2960-X, 1000 series, or L2 access-layer topologies.<\/td>\n | Catalyst 3850, 9300, 9500 series, and Core\/Distribution layers.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n<\/span>Verification and Troubleshooting Diagnostics<\/span><\/h2>\nOnce configured, verify gateway reachability and diagnose any issues that prevent off-subnet management access.<\/p>\n <\/span>How do I check the configured default gateway on a Layer 2 switch?<\/span><\/h3>\nExecute the show ip default-gateway<\/code> command or inspect the active IP configuration:<\/p>\nSwitch# show ip default-gateway\n192.168.10.1\n<\/code><\/pre>\nYou can also view the gateway and interface settings simultaneously using show ip redirects<\/code> or by filtering the running configuration:<\/p>\nSwitch# show running-config | include ip default-gateway\nip default-gateway 192.168.10.1\n<\/code><\/pre>\n<\/span>How do I verify the default gateway on a Layer 3 switch?<\/span><\/h3>\nUse the show ip route<\/code> command to confirm that the Gateway of Last Resort is properly set:<\/p>\nSwitch# show ip route 0.0.0.0\nRouting entry for 0.0.0.0\/0, supernet\n Known via "static", distance 1, metric 0, candidate default path\n Routing Descriptor Blocks:\n * 192.168.10.1\n Route metric is 0, share count 1\n<\/code><\/pre>\nLook for the S*<\/code> flag in the routing table, which indicates a candidate default static route.<\/p>\n<\/span>Why is the default gateway unreachable when pinged from the switch?<\/span><\/h3>\nIf issuing ping 192.168.10.1<\/code> fails, check the following common causes:
\n1. SVI Status Is Down\/Down<\/strong>: If no physical access port assigned to the management VLAN is connected, or if the VLAN is not active on any trunk link, the SVI enters a down\/down<\/code> state. Check with show ip interface brief<\/code>.
\n2. Missing VLAN Definition<\/strong>: The VLAN interface exists (interface vlan 10<\/code>), but the VLAN itself was never created in the database. Verify with show vlan brief<\/code>.
\n3. Subnet Mask Mismatch<\/strong>: The switch IP and gateway IP do not share an identical network address and subnet mask.
\n4. Trunk Pruning<\/strong>: An upstream 802.1Q trunk port is pruning the management VLAN via the switchport trunk allowed vlan<\/code> list.<\/p>\n<\/span>Why can the switch ping the gateway, but remote users cannot connect via SSH?<\/span><\/h3>\nThis symptom usually indicates that local Layer 2 ARP resolution is working, but return traffic cannot cross subnet boundaries:
\n– Missing Gateway Command on L2<\/strong>: The switch receives the incoming TCP SYN packet from a remote management workstation, but because ip default-gateway<\/code> is omitted, it has no route to return the TCP SYN-ACK and drops the packet.
\n– Access-Class Restrictions on VTY Lines<\/strong>: An Access Control List (ACL) applied to line vty 0 15<\/code> via access-class<\/code> is filtering the remote client’s source IP address. Verify using show running-config | section line vty<\/code>.<\/p>\n<\/span>What happens if both ip default-gateway<\/code> and ip route<\/code> exist in the configuration?<\/span><\/h3>\nCisco IOS resolves this based on the global routing state:
\n– If ip routing<\/code> is enabled, the switch uses the static default route (ip route 0.0.0.0 0.0.0.0<\/code>) and ignores ip default-gateway<\/code>.
\n– If routing is disabled (no ip routing<\/code>), the switch uses ip default-gateway<\/code> and ignores all ip route<\/code> statements.<\/p>\n
\n<\/span>Management IP and Default Gateway Configuration Templates<\/span><\/h2>\nUse the following configuration templates to deploy initial management settings. Replace bracketed values (e.g., <VLAN_ID><\/code>) with your site-specific network parameters.<\/p>\n<\/span>Template 1: Layer 2 Switch Management Template<\/span><\/h3>\n! ==========================================\n! CISCO LAYER 2 SWITCH MANAGEMENT TEMPLATE\n! ==========================================\nconfigure terminal\n\n! 1. Create and name the management VLAN\nvlan <MGMT_VLAN_ID>\n name MANAGEMENT\n exit\n\n! 2. Configure the Switch Virtual Interface (SVI)\ninterface vlan <MGMT_VLAN_ID>\n description Switch_Management_Interface\n ip address <SWITCH_MANAGEMENT_IP> <SUBNET_MASK>\n no shutdown\n exit\n\n! 3. Define the Layer 2 Default Gateway\nip default-gateway <DEFAULT_GATEWAY_IP>\n\n! 4. Commit changes to NVRAM\nend\ncopy running-config startup-config\n<\/code><\/pre>\n<\/span>Template 2: Layer 3 Multilayer Switch Management Template<\/span><\/h3>\n! ==========================================\n! CISCO LAYER 3 MULTILAYER SWITCH TEMPLATE\n! ==========================================\nconfigure terminal\n\n! 1. Enable Global Hardware\/Software IP Routing\nip routing\n\n! 2. Create Management VLAN and SVI\nvlan <MGMT_VLAN_ID>\n name MANAGEMENT\n exit\n\ninterface vlan <MGMT_VLAN_ID>\n description Multilayer_Management_SVI\n ip address <SWITCH_MANAGEMENT_IP> <SUBNET_MASK>\n no shutdown\n exit\n\n! 3. Configure the Static Gateway of Last Resort\nip route 0.0.0.0 0.0.0.0 <NEXT_HOP_ROUTER_IP>\n\n! 4. Clean up any redundant L2 gateway statements\nno ip default-gateway\n\n! 5. Commit changes to NVRAM\nend\nwrite memory\n<\/code><\/pre>\n
\n<\/span>Cisco IOS and IOS-XE Command Reference Standards
| | | | | | | | | | | | | | | | |