Primary Use Case<\/strong><\/td>\n| In-band switch management, default gateways for end-user subnets<\/td>\n | Point-to-point core links, router uplinks, and routed access designs<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Section Takeaway:<\/strong> Use an SVI when you need remote management on a Layer 2 switch or inter-VLAN routing across multiple access ports; use a routed port on Layer 3 switches when connecting directly to upstream routers or core distribution switches.<\/p>\n
\n<\/span>Configuring a Management IP on an SVI (VLAN Interface)<\/span><\/h2>\nOn traditional access-layer switches, an IP address is assigned to an SVI. While Cisco switches default to interface Vlan1<\/code> for initial setup, production networks should isolate administrative traffic onto a dedicated, out-of-band management VLAN (e.g., VLAN 10 or VLAN 99) to mitigate broadcast storms and unauthorized access risks.<\/p>\nFollow these sequential steps from the Cisco IOS Command-Line Interface (CLI):<\/p>\n <\/span>Step 1: Enter Global Configuration Mode<\/span><\/h3>\nEstablish a direct console connection or local session, access privileged EXEC mode, and enter global configuration mode:<\/p>\n Switch> enable\nSwitch# configure terminal\nEnter configuration commands, one per line. End with CNTL\/Z.\nSwitch(config)#\n<\/code><\/pre>\n<\/span>Step 2: Create the Management VLAN<\/span><\/h3>\nDefine the VLAN within the local database if it does not already exist:<\/p>\n Switch(config)# vlan 10\nSwitch(config-vlan)# name Management\nSwitch(config-vlan)# exit\n<\/code><\/pre>\n<\/span>Step 3: Enter SVI Configuration Mode<\/span><\/h3>\nCreate or access the logical Layer 3 interface for that specific VLAN ID:<\/p>\n Switch(config)# interface vlan 10\nSwitch(config-if)#\n<\/code><\/pre>\n<\/span>Step 4: Assign the IPv4 Address and Subnet Mask<\/span><\/h3>\nConfigure the desired static IPv4 address and network mask using the ip address<\/code> command:<\/p>\nSwitch(config-if)# ip address 192.168.10.15 255.255.255.0\n<\/code><\/pre>\n<\/span>Step 5: Enable the Virtual Interface<\/span><\/h3>\nBy default, newly instantiated SVIs reside in an administratively down state. Issue the no shutdown<\/code> command to bring the interface up:<\/p>\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 6: Map an Access Port to the Management VLAN<\/span><\/h3>\nAn SVI remains down unless at least one physical port participating in that VLAN is in an operational up\/up<\/code> state. Assign a physical interface to your management VLAN:<\/p>\nSwitch(config)# interface GigabitEthernet1\/0\/24\nSwitch(config-if)# switchport mode access\nSwitch(config-if)# switchport access vlan 10\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 7: Verify Interface Status<\/span><\/h3>\nExit configuration mode and inspect the interface state using the summary command:<\/p>\n Switch# show ip interface brief | include Vlan\nVlan10 192.168.10.15 YES manual up up\n<\/code><\/pre>\nSection Takeaway:<\/strong> An SVI requires both administrative activation (no shutdown<\/code>) and at least one active, operational physical port carrying that VLAN before its line protocol transitions to the up<\/code> state.<\/p>\n
\n<\/span>Assigning an IP Address to a Physical Port on a Layer 3 Switch<\/span><\/h2>\nWhen deploying a Layer 3 switch within a collapsed core or distribution layer, you often connect directly to an edge router or firewall. Rather than creating transit VLANs and SVIs for every point-to-point link, you can convert physical Ethernet ports into routed ports.<\/p>\n Follow these steps to configure an IP address directly on a physical interface:<\/p>\n <\/span>Step 1: Enable Global IP Routing<\/span><\/h3>\nLayer 3 Cisco switches must have IP routing active to process and route packets across routed interfaces:<\/p>\n Switch> enable\nSwitch# configure terminal\nSwitch(config)# ip routing\n<\/code><\/pre>\n<\/span>Step 2: Select the Target Physical Port<\/span><\/h3>\nNavigate to the interface configuration context for the physical port connecting to the upstream device:<\/p>\n Switch(config)# interface GigabitEthernet1\/0\/1\n<\/code><\/pre>\n<\/span>Step 3: Strip Layer 2 Switching Capabilities<\/span><\/h3>\nExecute the no switchport<\/code> command. This disables Layer 2 protocols (including spanning tree, trunking negotiation, and VLAN membership) and converts the interface into a Layer 3 routed port:<\/p>\nSwitch(config-if)# no switchport\n<\/code><\/pre>\n<\/span>Step 4: Assign the IP Address and Subnet Mask<\/span><\/h3>\nConfigure the point-to-point IPv4 address. Point-to-point links commonly utilize \/30<\/code> (255.255.255.252<\/code>) or \/31<\/code> (255.255.255.254<\/code>) subnet masks:<\/p>\nSwitch(config-if)# ip address 10.0.0.1 255.255.255.252\n<\/code><\/pre>\n<\/span>Step 5: Enable the Physical Interface<\/span><\/h3>\nBring the port out of administrative shutdown:<\/p>\n Switch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 6: Confirm Layer 3 Operational State<\/span><\/h3>\nVerify that the interface is recognized as a routed port and that the IP address is active:<\/p>\n Switch# show ip interface brief GigabitEthernet1\/0\/1\nInterface IP-Address OK? Method Status Protocol\nGigabitEthernet1\/0\/1 10.0.0.1 YES manual up up\n<\/code><\/pre>\nYou can also run show interfaces GigabitEthernet1\/0\/1 switchport<\/code> to confirm that the output displays Switchport: Disabled<\/code>.<\/p>\nSection Takeaway:<\/strong> The no switchport<\/code> command eliminates Layer 2 overhead from a physical port, turning it into a dedicated Layer 3 interface capable of holding an IP address and terminating routed links.<\/p>\n
\n<\/span>Configuring a Default Gateway for Remote Access<\/span><\/h2>\nAssigning an IP address allows communication within the switch’s local broadcast domain or directly attached subnet. However, if your network administrator attempts to reach the switch from a remote workstation, jump host, or centralized monitoring platform located in another subnet, traffic will fail unless the switch knows how to return the packets.<\/p>\n The method used to configure default egress routing depends on whether your switch operates as a Layer 2 or Layer 3 device.<\/p>\n <\/span>Method A: Layer 2 Switch (ip default-gateway<\/code>)<\/span><\/h3>\nOn pure Layer 2 switches (or Layer 3 switches with IP routing turned off), the device acts like a standard IP host. Configure the IP address of your local upstream router or default gateway:<\/p>\n Switch(config)# ip default-gateway 192.168.10.1\n<\/code><\/pre>\nVerification:<\/em><\/p>\nSwitch# show ip default-gateway\n192.168.10.1\n<\/code><\/pre>\n\nImportant Operational Rule:<\/strong> The ip default-gateway<\/code> address must reside within the identical subnet configured on your active management SVI.<\/p>\n<\/blockquote>\n<\/span>Method B: Layer 3 Switch (ip route<\/code>)<\/span><\/h3>\nWhen global IP routing is enabled (ip routing<\/code>), a Cisco switch ignores the ip default-gateway<\/code> directive. Instead, you must inject a static default route (gateway of last resort) into its routing table:<\/p>\nSwitch(config)# ip routing\nSwitch(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.2\n<\/code><\/pre>\n(Where 10.0.0.2<\/code> represents the IP of the upstream router or next-hop Layer 3 firewall.)<\/em><\/p>\nVerification:<\/em><\/p>\nSwitch# show ip route static\nGateway of last resort is 10.0.0.2 to network 0.0.0.0\n\nS* 0.0.0.0\/0 [1\/0] via 10.0.0.2\n<\/code><\/pre>\nSection Takeaway:<\/strong> Apply ip default-gateway<\/code> exclusively on Layer 2 switches; on Layer 3 switches with ip routing<\/code> active, always define a static default route via ip route 0.0.0.0 0.0.0.0 <next-hop><\/code>.<\/p>\n
\n<\/span>Basic IP Configuration CLI Templates<\/span><\/h2>\n
|