Every network I’ve ever built started the same way — unboxing a new Cisco switch, connecting a console cable, and going through the same set of initial configuration steps before anything else could happen. It’s a process that becomes second nature after a while, but it’s also easy to skip steps when you’re in a hurry, which is exactly how misconfigurations creep in. In this guide, I’ll walk through the complete initial setup of a Cisco switch — from the very first console connection to VLANs, management access, and day-one hardening.
Understanding the Cisco Switch Out-of-the-Box State
A brand-new Cisco switch, straight from the factory, has no configuration beyond the manufacturer defaults. It has no hostname, no passwords, no VLANs beyond the default VLAN 1, and no IP address assigned to any management interface. Before it can be remotely managed or properly integrated into a network, it needs a baseline configuration applied via direct console access.
Connecting to the Switch
The very first connection to any unconfigured Cisco switch must be made through the console port, using a console cable (typically USB-to-RJ45 on modern equipment) and a terminal emulator like PuTTY, SecureCRT, or Tera Term, configured with these standard serial settings:
- Baud rate: 9600
- Data bits: 8
- Parity: None
- Stop bits: 1
- Flow control: None
Step 1: Basic Global Configuration
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# enable secret C1sc0Str0ngP@ss!
SW1(config)# no ip domain-lookup
no ip domain-lookup disables the switch’s attempt to resolve mistyped commands as DNS lookups, which otherwise causes an annoying delay every time you make a typo at the CLI.
Step 2: Configuring the Management VLAN and IP Address
Cisco switches (in their default Layer 2-only role) are managed through a Switch Virtual Interface (SVI), typically on VLAN 1 by default, though best practice is to move management to a dedicated VLAN.
SW1(config)# vlan 99
SW1(config-vlan)# name MANAGEMENT
SW1(config-vlan)# exit
SW1(config)# interface Vlan99
SW1(config-if)# ip address 10.10.99.2 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# ip default-gateway 10.10.99.1
ip default-gateway is required on a Layer 2 switch so that management traffic destined outside the local subnet (like SSH sessions from a remote admin PC) can be routed correctly.
Step 3: Securing Console, VTY, and Enable Access
SW1(config)# line console 0
SW1(config-line)# password C0ns0leP@ss
SW1(config-line)# login
SW1(config-line)# exec-timeout 5 0
SW1(config-line)# logging synchronous
SW1(config-line)# exit
SW1(config)# username admin privilege 15 secret Adm1nP@ss
SW1(config)# ip domain-name awjunaid.local
SW1(config)# crypto key generate rsa modulus 2048
SW1(config)# ip ssh version 2
SW1(config)# line vty 0 4
SW1(config-line)# login local
SW1(config-line)# transport input ssh
SW1(config-line)# exec-timeout 10 0
SW1(config-line)# exit
Step 4: Creating VLANs and Assigning Access Ports
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name SERVERS
SW1(config-vlan)# exit
SW1(config)# interface range FastEthernet0/1 - 12
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10
SW1(config-if-range)# spanning-tree portfast
SW1(config-if-range)# exit
Step 5: Configuring Trunk Ports
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,99
SW1(config-if)# switchport trunk native vlan 999
SW1(config-if)# exit
Step 6: Disabling Unused Ports
Any port not currently in use should be administratively shut down and, ideally, placed in an unused “parking lot” VLAN to reduce the attack surface:
SW1(config)# vlan 666
SW1(config-vlan)# name UNUSED
SW1(config-vlan)# exit
SW1(config)# interface range FastEthernet0/13 - 24
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 666
SW1(config-if-range)# shutdown
SW1(config-if-range)# exit
Step 7: Setting Spanning Tree Mode
SW1(config)# spanning-tree mode rapid-pvst
Rapid PVST+ provides significantly faster convergence after a topology change compared to legacy 802.1D STP, and is the standard choice on modern Cisco switches.
Step 8: Saving the Configuration
SW1# copy running-config startup-config
Destination filename [startup-config]?
Building configuration...
[OK]
Never skip this step — a switch that loses power before its configuration is saved will boot back up with none of your changes applied.
Verification
SW1# show running-config
SW1# show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active
10 SALES active Fa0/1, Fa0/2, Fa0/3
20 SERVERS active
99 MANAGEMENT active
666 UNUSED active Fa0/13, Fa0/14
SW1# show ip interface brief
Interface IP-Address OK? Method Status Protocol
Vlan99 10.10.99.2 YES manual up up
SW1# show interfaces status
Port Name Status Vlan Duplex Speed Type
Fa0/1 connected 10 a-full a-100 10/100BaseTX
Fa0/13 disabled 666 auto auto 10/100BaseTX
SW1# show spanning-tree summary
Switch is in rapid-pvst mode
Real-World Enterprise Scenario
Consider a company rolling out a new access-layer switch to support a newly built office floor. The standard enterprise deployment workflow looks like this: rack and cable the switch, connect via console for initial setup, apply the organization’s standard hardening template (hostname, enable secret, SSH-only management, NTP, syslog), create the VLANs matching the floor’s departmental layout, configure access ports with port security and PortFast, configure the uplink as a trunk to the distribution switch, disable and park unused ports, verify with show commands, and finally save the configuration and back it up to a centralized configuration management system before the switch goes into production. This exact sequence — often standardized into a documented runbook — is what most enterprises follow for every new switch deployed.
Security Considerations
- Always disable unused ports and park them in an isolated VLAN.
- Use SSH exclusively for remote management; disable Telnet.
- Implement port security on access ports to limit the number of MAC addresses allowed and prevent unauthorized device connections:
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security violation restrict
SW1(config-if)# switchport port-security mac-address sticky
- Enable DHCP snooping to prevent rogue DHCP servers from being introduced onto the network:
SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 10,20
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# ip dhcp snooping trust
- Move management traffic off VLAN 1 and onto a dedicated management VLAN, as shown in Step 2.
- Configure logging to a centralized syslog server for audit visibility:
SW1(config)# logging host 10.10.99.50
Best Practices
- Always follow a consistent naming and numbering convention across all switches in your organization.
- Document your VLAN scheme, IP addressing plan, and port assignments before deployment, not after.
- Use
interface rangefor bulk configuration rather than configuring ports one by one. - Configure NTP so that logs and certificates have accurate, synchronized timestamps:
SW1(config)# ntp server 10.10.99.10
- Back up configurations regularly, ideally through an automated configuration management tool rather than manual
copy running-config startup-configalone.
Optimization and Performance Tuning
- Use
spanning-tree mode rapid-pvstfor faster failover in redundant topologies. - Enable PortFast only on access ports connecting to end devices, never on switch-to-switch links, since it bypasses STP’s normal listening and learning states.
- Monitor interface errors and utilization regularly with
show interfacesto catch duplex mismatches or bandwidth saturation early. - For switches supporting it, enable EtherChannel on redundant uplinks to increase available bandwidth and provide link-level redundancy:
SW1(config)# interface range GigabitEthernet0/1 - 2
SW1(config-if-range)# channel-group 1 mode active
Troubleshooting and Common Configuration Mistakes
Mistake 1: Forgetting no shutdown on the management SVI The management VLAN interface (like Vlan99) is administratively down by default and won’t pass traffic until explicitly enabled with no shutdown.
Mistake 2: Missing default gateway on the switch Without ip default-gateway, the switch can be reached from its local subnet, but remote management from outside that subnet will fail.
Mistake 3: Not saving the configuration Forgetting copy running-config startup-config means any power loss or reload wipes all configuration changes.
Mistake 4: Duplex or speed mismatches Leaving both ends of a link on auto-negotiation is usually fine, but mismatched manual settings on either side of a link cause significant performance degradation and are a very common real-world troubleshooting scenario.
Useful troubleshooting commands:
SW1# show running-config
SW1# show ip interface brief
SW1# show vlan brief
SW1# show interfaces status
SW1# show spanning-tree summary
SW1# show mac address-table
Frequently Asked Questions
Q: Do all Cisco switches need an IP address to function? No — a switch can forward traffic at Layer 2 with zero IP configuration; an IP address (via an SVI) is only required for remote management access to the switch itself.
Q: What’s the difference between a Layer 2 and Layer 3 switch? A Layer 2 switch forwards frames based on MAC addresses within VLANs, while a Layer 3 switch can additionally route between VLANs using SVIs, functioning much like a router in addition to its switching role.
Q: Why is no ip domain-lookup recommended? Without it, a mistyped command at the CLI causes the switch to attempt a DNS lookup for that “hostname,” resulting in an annoying delay before the invalid command error is returned.
Q: How many VLANs can I create during initial setup? There’s no strict limit for initial setup purposes, but only create the VLANs your current network design actually requires; you can always add more later as needed.
Q: What’s the safest way to handle unused switch ports? Administratively shut them down and assign them to a dedicated, unused “parking lot” VLAN, rather than leaving them active in the default VLAN.
Summary and Key Takeaways
Setting up a Cisco switch from scratch follows a consistent, repeatable process: establish console access, apply a hostname and enable secret, configure a management SVI and default gateway, secure console and VTY access with SSH, create your VLANs and assign access ports, configure trunk links, disable unused ports, set spanning tree mode, and save the configuration. Following this sequence consistently — and layering in port security, DHCP snooping, and centralized logging — gives you a properly hardened, production-ready switch from day one rather than something that needs to be retrofitted with security later.
References
- Cisco Catalyst Switch Software Configuration Guide: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-x/configuration_guide/b_173_9300_cg.html
- Cisco Port Security Configuration Guide: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-x/configuration_guide/sec/b_173_sec_9300_cg/configuring_port_based_traffic_control.html
