Skip to content
Dispatching · New York Metro
(347) 262-9435
Field guide · Switching & configuration

Switch config

A configuration walkthrough in the order you actually do it: identity, management address, secure access, VLANs, access and trunk ports, spanning tree, then hardening. Every block is copyable and every line says why it is there rather than just what it does.

Plate 01Configuration

Nine blocks,
in the order you run them

Fill in your own values and they are substituted into every block below. The syntax is Cisco IOS — the reasoning applies to any managed switch, the exact commands do not.

Your values

Substituted into every block below. Nothing is transmitted — this runs entirely in your browser.

Not VLAN 1.

A dead VLAN, shut down.

  1. 01Identity and administrative access

    First, because everything after this is done over a session that should already be authenticated and encrypted. A switch configured VLAN-first spends its whole commissioning window reachable by anyone on the segment with a console cable and a guess.

    configure terminal hostname SW-FLOOR3-IDF1 ip domain-name corp.example.com ! service password-encryption enable algorithm-type scrypt secret <strong-password> username netadmin privilege 15 algorithm-type scrypt secret <strong-password> ! no ip domain-lookup

    Values in hi-vis angle brackets are yours to fill in — they are secrets, and nothing that belongs in a page like this.

    CautionAn enable secret set with `enable password` instead of `enable secret` is stored reversibly. It is not a password, it is a delay.

  2. 02Management interface

    The switch needs an address on a VLAN that end devices are not on. Putting management on the same VLAN as workstations means every compromised laptop shares a broadcast domain with the device that controls the network it sits on.

    vlan 90 name MGMT!interface Vlan90 description Switch management ip address 10.90.0.11 255.255.255.0 no shutdown!ip default-gateway 10.90.0.1

    CautionLeaving management on VLAN 1 puts the switch's own interface on the VLAN every unconfigured port defaults to.

  3. 03SSH, and closing telnet

    Generating a key and setting `transport input ssh` is the whole job. The part people miss is that enabling SSH does not disable telnet — the vty lines accept both until you say otherwise, so the encrypted option sits alongside the plaintext one indefinitely.

    crypto key generate rsa modulus 2048!ip ssh version 2ip ssh time-out 60ip ssh authentication-retries 3!line vty 0 15 transport input ssh login local exec-timeout 10 0!line con 0 login local exec-timeout 15 0

    CautionTelnet left reachable is the single most common finding on a handover review, and it carries the credentials in clear text.

  4. 04VLANs

    Segment by what a device is rather than where it sits. Cameras, phones, and workstations have different traffic patterns, different patch cycles, and very different consequences when one of them is compromised.

    vlan 10 name DATAvlan 20 name VOICEvlan 30 name CAMERAvlan 999 name NATIVE-UNUSED shutdown

  5. 05Access ports

    Set the mode explicitly. A port left on the default dynamic setting can be negotiated into a trunk by whatever is plugged into it, which turns a desk port into a path to every VLAN on the switch.

    interface range GigabitEthernet1/0/1-44 description Access - workstation/phone switchport mode access switchport access vlan 10 switchport voice vlan 20 switchport nonegotiate spanning-tree portfast spanning-tree bpduguard enable switchport port-security switchport port-security maximum 3 switchport port-security violation restrict switchport port-security aging time 5 storm-control broadcast level 2.00 no shutdown

    CautionPortFast without BPDU Guard removes the delay that would have caught somebody plugging a switch into a desk port.

  6. 06Uplink trunk

    Prune the allowed list to the VLANs the far end actually needs, and move the native VLAN off 1 to something dead. An unpruned trunk carries every broadcast domain to every closet, which is how one storm becomes a site-wide outage.

    interface GigabitEthernet1/0/48 description Uplink to core switchport mode trunk switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,30,90 switchport nonegotiate no shutdown

    CautionA native VLAN mismatch between the two ends of a trunk silently merges two VLANs, and nothing logs it as an error.

  7. 07Spanning tree

    Set the root explicitly. Left to elect itself, the root bridge becomes whichever switch has the lowest MAC address — reliably the oldest box in the building, which is then carrying the whole topology.

    spanning-tree mode rapid-pvstspanning-tree vlan 10,20,30,90 priority 24576spanning-tree portfast bpduguard defaultspanning-tree loopguard default

  8. 08Services, logging, and time

    Turn off what you are not using, and make sure what remains produces a timestamped record. Logs without NTP are the reason an incident timeline cannot be reconstructed six months later.

    no ip http serverno ip http secure-serverno cdp run!ntp server 10.0.0.10 preferntp server 10.0.0.11clock timezone EST -5clock summer-time EDT recurring!service timestamps log datetime msec localtime show-timezonelogging host 10.0.0.20logging trap informational!snmp-server group MONITOR v3 privsnmp-server user <monitor-user> MONITOR v3 auth sha <auth-pass> priv aes 128 <priv-pass>!banner login ^C Authorised access only. Activity is logged. ^C

    Values in hi-vis angle brackets are yours to fill in — they are secrets, and nothing that belongs in a page like this.

  9. 09Verify, then save

    Check before you write. A configuration that locks you out is recoverable while it is only running; once it is in startup-config and the switch is in a locked closet, it is a site visit.

    do show running-config | include ^hostname|^ip ssh|transport inputdo show vlan briefdo show interfaces trunkdo show spanning-tree summaryend!write memory

    CautionEverything above lives in volatile memory until it is written. A power blip undoes the entire commissioning.

Plate 02Before you hand it over

A configuration is finished when somebody else could inherit it without asking you anything.

That means the descriptions are filled in, the VLAN names say what they carry, the trunk is pruned to what the far end needs, and telnet is gone rather than merely unused. Most of what gets flagged on a handover review is not a mistake — it is a default that nobody turned off, sitting exactly where the factory left it.

If you have inherited a switch and want to know what is sitting in it, paste the running-config into the config auditor — it flags the same things a review would, with the line numbers.

Handover checklist
  • Every port has a description that names what is on it.
  • Management is off VLAN 1, and VLAN 1 carries nothing.
  • Telnet is closed, not just unused. SSH is version 2.
  • Trunk allowed-lists are pruned; native VLAN is dead and matches at both ends.
  • Access ports: mode set explicitly, PortFast and BPDU Guard together.
  • Root bridge priority is set, not elected.
  • NTP is reachable and logs are timestamped.
  • Written to startup-config, and the config is backed up somewhere off the switch.
Plate 03Questions
Questions people actually ask
What is the first thing to configure on a new switch?
Identity and access, before anything else: hostname, a local user, an enable secret, and SSH. Configuring VLANs first means doing the rest of the work over an unencrypted console session on a device anybody on the segment can reach.
Should I use VLAN 1 for management?
No. VLAN 1 is where every unconfigured port lands and where control-plane traffic lives, so anything plugged into an untouched port shares a broadcast domain with your management interface. Create a dedicated management VLAN and leave VLAN 1 empty.
What is the difference between an access port and a trunk port?
An access port carries a single untagged VLAN and is what end devices plug into. A trunk carries several VLANs at once, tagging each frame with 802.1Q so the switch at the far end can separate them again.
Why do PortFast and BPDU Guard go together?
PortFast skips the spanning-tree delay so a workstation gets a link immediately, but it also removes the pause that would have caught a switch plugged into a desk port. BPDU Guard restores that protection by shutting the port down the moment it sees a BPDU.
Plate —Other guides

The rest of the section

Free guidesNo sign-upNothing trackedWritten on the job
Rather it was just done

We do this work
as well as document it

Anyone commissioning a switch, or inheriting one and wanting to know what a complete configuration should contain.

Get a free estimateSee services
Or call and speak to someone who does the work(347) 262-9435inquiries@jcitsystems.com