1.1.7 Lab - Basic Switch Configuration

Introduction: What Is a Basic Switch Configuration?

In modern networks, a switch is the workhorse that connects end‑devices—computers, printers, IP phones—and forwards Ethernet frames based on MAC addresses. Plus, 7 focuses on the essential steps that turn a brand‑new, out‑of‑the‑box switch into a functional layer‑2 device. On top of that, 1. That's why while high‑end chassis switches support complex routing protocols, VLAN trunking, and QoS policies, the basic switch configuration covered in lab 1. Mastering these fundamentals gives you a solid foundation for more advanced topics such as VLAN segmentation, spanning‑tree tuning, and security hardening.

This article walks you through every command you’ll need in a typical Cisco‑style CLI environment, explains the underlying concepts, and answers common questions that arise during the lab. By the end, you’ll be able to configure a switch from scratch, verify its operation, and troubleshoot the most frequent issues—skills that are directly applicable to real‑world deployments and certification exams Most people skip this — try not to..

1. Lab Objectives and Required Equipment

Equipment needed

• One Cisco Catalyst or comparable IOS‑based switch (e.g., 2960, 3560).
• Console cable (RJ‑45 to DB‑9) and a terminal emulator (PuTTY, Tera Term, or similar).
• A laptop with an Ethernet NIC configured in the same subnet as the management VLAN.
• Optional: a second switch or a router to test inter‑VLAN connectivity.

2. Connecting to the Switch

1. Physical connection – Plug the console cable into the switch’s console port and connect the other end to the laptop’s serial or USB‑to‑serial adapter.
2. Terminal settings – Use 9600 bps, 8 data bits, no parity, 1 stop bit, and no flow control.
3. Power on – Turn on the switch; you should see the boot sequence followed by the Switch> prompt.

At the Switch> prompt you are in user EXEC mode, which only permits read‑only commands. To make configuration changes you must enter privileged EXEC mode That's the whole idea..

Switch> enable
Switch#

If an enable password is already set, you’ll be prompted to enter it. In a lab environment the default is often blank, but always test the password policy before proceeding.

3. Setting a Hostname and Securing Access

A clear hostname makes troubleshooting easier, especially when you manage multiple devices And that's really what it comes down to..

Switch# configure terminal
Enter configuration mode ^

Switch(config)# hostname LabSwitch
LabSwitch(config)#

3.1 Configuring an Enable Secret

The enable secret command stores a hashed password, which is far more secure than the reversible enable password Simple, but easy to overlook. Took long enough..

LabSwitch(config)# enable secret MyStrongP@ssw0rd

Tip: Use a passphrase that is at least 12 characters, mixes upper/lower case, numbers, and special symbols. The secret is saved in the configuration file as a SHA‑256 hash.

3.2 Disabling Unused Services

By default, Cisco switches enable several services that may not be needed in a lab or production environment. Turning them off reduces the attack surface.

LabSwitch(config)# no cdp run          ! Disable Cisco Discovery Protocol
LabSwitch(config)# no ip http server   ! Turn off the built‑in web server
LabSwitch(config)# no ip http secure-server

4. Configuring Management Interface (VLAN 1)

Most Cisco switches use VLAN 1 as the default management VLAN. Assigning an IP address to this VLAN provides out‑of‑band access.

LabSwitch(config)# interface vlan 1
LabSwitch(config-if)# ip address 192.168.10.2 255.255.255.0
LabSwitch(config-if)# no shutdown
LabSwitch(config-if)# exit

4.1 Setting a Default Gateway

If the management station resides on a different subnet, the switch needs a default route Simple as that..

LabSwitch(config)# ip default-gateway 192.168.10.1

Why not use a routed interface? In a pure layer‑2 switch, ip default-gateway is the correct command. On the flip side, if you later enable Layer 3 routing (e. g.This leads to , on a multilayer switch), you would replace it with ip route 0. 0.Which means 0. In practice, 0 0. Here's the thing — 0. 0.0 <next‑hop> Worth keeping that in mind. That alone is useful..

5. Enabling Secure Remote Access (SSH)

5.1 Generating RSA Keys

SSH requires a host key pair. The following command creates a 2048‑bit RSA key, which is sufficient for most lab scenarios.

LabSwitch(config)# ip domain-name lab.local
LabSwitch(config)# crypto key generate rsa general-keys modulus 2048

You’ll see a confirmation that the keys have been generated Surprisingly effective..

5.2 Creating a Local User

For SSH authentication, define a local username with a strong password.

LabSwitch(config)# username labadmin privilege 15 secret S3cure!Pass

5.3 Activating the SSH Server

LabSwitch(config)# ip ssh version 2
LabSwitch(config)# line vty 0 4
LabSwitch(config-line)# transport input ssh
LabSwitch(config-line)# login local
LabSwitch(config-line)# exit

Now you can connect from the laptop using an SSH client:

ssh labadmin@192.168.10.2

6. Saving the Configuration

Cisco devices store the running configuration in RAM. To make changes survive a reload, copy it to NVRAM And that's really what it comes down to..

LabSwitch# copy running-config startup-config
Destination filename [startup-config]? 
Building configuration...
[OK]

You can verify the saved file with:

LabSwitch# show startup-config

7. Verification and Troubleshooting

7.1 Basic show Commands

7.2 Connectivity Tests

1. Ping the switch from the laptop

   ping 192.168.10.2
   

   Successful replies confirm that the management VLAN is reachable.

2. Ping a remote device (e.g., the default‑gateway)

   ping 192.168.10.1
   

   If this fails, double‑check the ip default-gateway setting and the physical link on the port connected to the upstream router That's the whole idea..

7.3 Common Issues and Fixes

8. Extending the Lab: Optional Enhancements

While the core lab stops at a functional, secure management configuration, many learners like to explore next‑level features:

1. Create a dedicated management VLAN (e.g., VLAN 10) and move the IP address off VLAN 1 to isolate management traffic.
2. Enable port security to limit the number of MAC addresses per access port, preventing rogue devices.
3. Configure a DHCP snooping trusted interface if the network supplies DHCP from a specific uplink.
4. Apply a basic ACL on the management VLAN to restrict which subnets can reach the switch via SSH.

These extensions reinforce the principle that a basic configuration is the stepping stone toward a hardened, production‑ready switch.

9. Frequently Asked Questions (FAQ)

Q1: Do I have to use VLAN 1 for management?
No. VLAN 1 is the default, but best practice recommends creating a separate management VLAN (e.g., VLAN 99) and assigning an IP address to that VLAN. This isolates management traffic from user data.

Q2: What is the difference between enable secret and enable password?
enable secret stores a hashed value (MD5 or SHA) making it unreadable, while enable password stores the password in clear text (or reversible encryption). Always prefer enable secret Small thing, real impact..

Q3: Can I use Telnet instead of SSH?
Technically yes, but Telnet transmits credentials in clear text. For any environment beyond a closed lab, SSH is mandatory for security compliance Practical, not theoretical..

Q4: Why does the switch not have a routing table?
A classic layer‑2 switch does not perform IP routing; it only forwards frames based on MAC addresses. If you need inter‑VLAN routing, you must use a multilayer switch or an external router Still holds up..

Q5: How do I reset the switch to factory defaults?

LabSwitch# write erase
LabSwitch# reload

This erases the startup‑config and reboots with the default configuration.

10. Conclusion

The basic switch configuration covered in lab 1.1.7 is more than a checklist; it establishes a secure, manageable foundation for any Ethernet network. By assigning a hostname, securing privileged access, configuring a management IP, setting a default gateway, disabling unnecessary services, and enabling SSH, you transform a blank‑out-of‑the‑box device into a professional-grade network component.

Remember that each command you type not only accomplishes a functional goal but also reinforces a security principle—least privilege, defense in depth, and visibility. Mastering these basics empowers you to tackle more sophisticated topics such as VLAN design, spanning‑tree optimization, and network automation with confidence.

Keep the lab environment handy, repeat the steps until they become second nature, and then experiment with the optional enhancements. The skills you develop here will serve you well in certification exams, real‑world deployments, and any future networking challenge you choose to pursue.