Switch(config)# interface vlan 10\nSwitch(config-if)# description In-Band Management SVI\nSwitch(config-if)# ip address 192.168.10.15 255.255.255.0\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\nEnsure that at least one physical port or trunk uplink carrying this VLAN is active; otherwise, the SVI will remain in an operational state of down\/down<\/code>.<\/p>\n<\/span>Step 3: Define the Default Gateway<\/span><\/h3>\nAssign the upstream router’s IP address residing on the same management subnet:<\/p>\n
Switch(config)# ip default-gateway 192.168.10.1\n<\/code><\/pre>\n<\/span>Step 4: Verify IP Routing Status<\/span><\/h3>\nEnsure that routing has not been inadvertently turned on on the Layer 2 switch:<\/p>\n
Switch(config)# no ip routing\nSwitch(config)# exit\n<\/code><\/pre>\n<\/span>Step 5: Save the Configuration to Non-Volatile Memory<\/span><\/h3>\nCommit the runtime configuration to NVRAM to ensure settings persist across reboots:<\/p>\n
Switch# copy running-config startup-config\nDestination filename [startup-config]? [Press Enter]\nBuilding configuration...\n[OK]\n<\/code><\/pre>\n<\/span>Architectural Comparison: ip default-gateway<\/code> vs. ip route 0.0.0.0 0.0.0.0<\/code><\/span><\/h2>\nA frequent configuration pitfall occurs on multilayer (Layer 3) switches where administrators configure ip default-gateway<\/code> and discover that outbound reachability fails. The choice between ip default-gateway<\/code> and a static default route (ip route 0.0.0.0 0.0.0.0<\/code>) depends entirely on whether the switch acts as a transparent Layer 2 device or as a Layer 3 routing engine.<\/p>\n\n\n\n| Evaluation Metric<\/th>\n | ip default-gateway <ip><\/code><\/th>\nip route 0.0.0.0 0.0.0.0 <next-hop><\/code><\/th>\n<\/tr>\n<\/thead>\n\n\nGlobal IP Routing State<\/strong><\/td>\nApplicable only<\/strong> when no ip routing<\/code> is active.<\/td>\nApplicable only<\/strong> when ip routing<\/code> is enabled.<\/td>\n<\/tr>\n\nDevice Architectural Role<\/strong><\/td>\n| Pure Layer 2 access switch.<\/td>\n | Layer 3 core, distribution, or routed access switch.<\/td>\n<\/tr>\n | \nRIB (Routing Information Base)<\/strong><\/td>\n| Does not populate the IP routing table; stored as a control-plane variable.<\/td>\n | Injected into the Routing Information Base (RIB) as a candidate default gateway (S*<\/code>).<\/td>\n<\/tr>\n\nTraffic Scope<\/strong><\/td>\nDirects traffic originated by the switch<\/strong> (SSH, Syslog, SNMP, NTP, Ping).<\/td>\nForwards both transit customer traffic<\/strong> and traffic originated by the switch.<\/td>\n<\/tr>\n\nForwarding Engine Integration<\/strong><\/td>\n| Software-driven control plane stack.<\/td>\n | Hardware-accelerated forwarding (ASIC\/TCAM via Cisco Express Forwarding – CEF).<\/td>\n<\/tr>\n | \nMulti-Path & Metric Support<\/strong><\/td>\n| Does not support administrative distance, metric weightings, or tracking.<\/td>\n | Supports administrative distance, floating static routes, ECMP, and IP SLA tracking.<\/td>\n<\/tr>\n | \nBehavior on Layer 3 Switch<\/strong><\/td>\nIgnored<\/strong> if ip routing<\/code> is enabled; results in management isolation.<\/td>\n| Preferred standard for all default next-hop path selections.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n On switches with routing capabilities (such as the Catalyst 3650, 3850, or 9300), running ip routing<\/code> converts the device into an active router. In this mode, the routing table takes precedence over everything. If your switch has ip routing<\/code> enabled, you must execute:<\/p>\nSwitch(config)# ip route 0.0.0.0 0.0.0.0 192.168.10.1\n<\/code><\/pre>\nIf you disable routing via no ip routing<\/code>, the static route will no longer function, and the device will rely exclusively on ip default-gateway<\/code>.<\/p>\n<\/span>Management VLAN and Default Gateway Configuration Template<\/span><\/h2>\nUse the following standardized script to rapidly provision management IP settings, remote access control, and default gateway parameters on a freshly unboxed or reset Cisco switch.<\/p>\n ! ======================================================================\n! CISCO SWITCH MANAGEMENT PROVISIONING TEMPLATE\n! Replace bracketed placeholders: <MGMT_VLAN_ID>, <SWITCH_IP>, <SUBNET_MASK>, <GATEWAY_IP>\n! ======================================================================\n\nenable\nconfigure terminal\n\n! --- Basic Device Identification ---\nhostname SW-ACCESS-01\nip domain-name enterprise.local\n\n! --- Disable Unnecessary Broadcast Services ---\nno ip domain-lookup\n\n! --- Management VLAN and SVI Provisioning ---\nvlan 10\n name OOB_Management\n exit\n\ninterface vlan 10\n description In-Band Management SVI\n ip address 192.168.10.50 255.255.255.0\n no shutdown\n exit\n\n! --- Default Gateway Declaration ---\n! Use for Layer 2 switches (no ip routing active)\nno ip routing\nip default-gateway 192.168.10.1\n\n! --- Secure Remote Management (SSH Setup) ---\ncrypto key generate rsa modulus 2048\nip ssh version 2\n\nusername admin privilege 15 secret SuperSecretPassword123!\n\nline vty 0 15\n session-timeout 15 0\n transport input ssh\n login local\n exit\n\n! --- Synchronous Logging & Session Security ---\nline con 0\n logging synchronous\n exec-timeout 10 0\n exit\n\n! --- Commit to NVRAM ---\nend\nwrite memory\n<\/code><\/pre>\n<\/span>Frequently Asked Questions About Default Gateway Verification<\/span><\/h2>\n<\/span>How do I check the configured default gateway on a Layer 2 switch?<\/span><\/h3>\nRun the privileged EXEC command:<\/p>\n Switch# show ip default-gateway\n<\/code><\/pre>\nThis command outputs the current next-hop IP address assigned to the switch control plane. Alternatively, you can filter the active configuration using:<\/p>\n Switch# show running-config | include ip default-gateway\nip default-gateway 192.168.10.1\n<\/code><\/pre>\n<\/span>Which command displays both SVI status and the gateway configuration simultaneously?<\/span><\/h3>\nRun show ip redirects<\/code>:<\/p>\nSwitch# show ip redirects\nDefault gateway is 192.168.10.1\n\nHost Gateway Last Use Total Uses Interface\nICMP redirect cache is empty\n<\/code><\/pre>\nThis command confirms whether the switch holds an active default gateway alongside the ICMP redirect cache table. To confirm that the SVI is physically up, pair this with show ip interface brief<\/code>.<\/p>\n<\/span>Why does show ip route<\/code> report “Default gateway is not set” or “IP routing is not enabled”?<\/span><\/h3>\nIf no ip routing<\/code> is active (the default state on Layer 2 switches), Cisco IOS does not maintain a standard IP routing table. Depending on the IOS release:
\n1. It may state: % IP routing not enabled<\/code>.
\n2. It may display a concise non-routing summary indicating: Default gateway is 192.168.10.1<\/code>.<\/p>\nIf IP routing is enabled (ip routing<\/code>), but you used ip default-gateway<\/code> instead of ip route 0.0.0.0 0.0.0.0<\/code>, show ip route<\/code> will display:<\/p>\nGateway of last resort is not set\n<\/code><\/pre>\nThis confirms that the switch is operating in Layer 3 mode and ignoring your ip default-gateway<\/code> statement.<\/p>\n<\/span>How do I verify gateway reachability from the switch CLI?<\/span><\/h3>\nExecute an ICMP ping directly to the gateway address:<\/p>\n Switch# ping 192.168.10.1\nType escape sequence to abort.\nSending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:\n.!!!!\nSuccess rate is 80 percent (4\/5), round-trip min\/avg\/max = 1\/2\/4 ms\n<\/code><\/pre>\n(Note: The initial packet loss .<\/code> is normal as the switch performs an initial ARP lookup for the gateway’s MAC address).<\/em><\/p>\n<\/span>Diagnostic Guide: Troubleshooting Gateway Reachability Issues<\/span><\/h2>\nWhen a switch cannot ping its default gateway or cannot be reached from external subnets, work through this systematic diagnostic workflow.<\/p>\n
| | | | | | | | | | | | | | | |