Cisco Switch Initial Setup Checklist

This checklist walks you through the physical installation, initial configuration, and verification steps for a new Cisco switch. You will learn what to do before powering on, how to access the command-line interface, and how to apply a secure baseline configuration.

Before You Start

Gather the following items and information before you begin:

• Console cable (usually a rollover cable with RJ-45 to DB-9 or USB) and a terminal emulator like PuTTY or Tera Term.
• The switch’s management IP address, subnet mask, and default gateway (if you plan to manage it over the network).
• Administrative credentials: a strong enable secret and a username/password for SSH.
• Firmware and configuration backups (if you are replacing an existing switch).
• Appropriate SFPs or copper cables for your uplinks and access ports.

Verify that the power supply matches your local voltage and that the rack or shelf can support the switch’s weight. Check the environmental requirements (temperature, humidity) in the datasheet.

Physical Installation

Mount the switch in a rack or on a flat surface, ensuring airflow is not blocked. Connect the console cable to the console port on the switch and to your computer. Do not connect any network cables yet. Power on the switch and wait for the system LED to turn green. You should see boot messages in the terminal emulator.

Initial Console Access

Configure your terminal emulator with these settings: 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control. Press Enter a few times to get the prompt. If you see a blank screen, check the cable and the COM port. Once you see the switch prompt (e.g., Switch>), you are ready to configure.

Basic Configuration Steps

Enter privileged EXEC mode and global configuration mode:

1. Type enable (the default enable password is usually empty).
2. Type configure terminal.
3. Set a hostname: hostname Access-SW1.
4. Set an enable secret: enable secret YourStrongPassword.
5. Create a local user for SSH: username admin privilege 15 secret AnotherStrongPassword.
6. Configure the management VLAN interface (usually VLAN 1): interface vlan 1 then ip address 192.168.1.2 255.255.255.0 and no shutdown.
7. Set the default gateway: ip default-gateway 192.168.1.1.
8. Enable SSH: ip domain-name example.com, crypto key generate rsa (use 2048 bits), then line vty 0 15 and transport input ssh and login local.
9. Save the configuration: end then write memory or copy running-config startup-config.

VLAN and Port Configuration

Create VLANs and assign ports to them. For example, to create VLAN 10 and assign ports 1-24:

vlan 10
  name Sales
interface range fa0/1-24
  switchport mode access
  switchport access vlan 10

For trunk ports (to connect to another switch or router), use switchport mode trunk and specify allowed VLANs. If you have a voice VLAN, configure it with switchport voice vlan 20.

Security and Management Hardening

Apply these baseline security settings:

• Disable unused ports: interface range fa0/25-48 then shutdown.
• Enable port security on access ports: switchport port-security and set maximum MAC addresses.
• Set a banner message: banner motd ^C Unauthorized access prohibited. ^C.
• Disable the web interface if not needed: no ip http server.
• Set SSH timeout and authentication retries: ip ssh time-out 60 and ip ssh authentication-retries 3.

Verification and Testing

After configuration, verify the switch is working correctly:

1. Check the running configuration: show running-config.
2. Verify VLANs: show vlan brief.
3. Check interfaces: show interfaces status.
4. Test connectivity from a PC on the same VLAN: ping the switch’s management IP.
5. Test SSH: from your computer, ssh admin@192.168.1.2.
6. Check the logs: show logging.

Common Mistakes to Avoid

Many first-time setups fail due to a few recurring issues:

• Forgetting to set the default gateway, so the switch cannot be reached from other subnets.
• Using a straight-through cable for console (must be rollover).
• Not saving the configuration, losing changes on reboot.
• Leaving the default enable password (which is empty).
• Configuring an access port with a VLAN that does not exist (the port will be inactive).

Frequently Asked Questions

What is the default IP address of a new Cisco switch?

There is no default IP address. You must assign one via the console port. The switch comes with all ports in VLAN 1 and no management IP configured.

How do I reset a Cisco switch to factory defaults?

Use the write erase command to delete the startup configuration, then reload. This removes all configured settings, including VLANs and passwords. The switch will boot to the initial setup dialog.

Do I need a console cable for initial setup?

Yes, for a brand-new or fully reset switch, the console port is the only way to access the CLI. After you configure an IP address and SSH, you can manage it over the network.

What is the difference between an access port and a trunk port?

An access port belongs to a single VLAN and carries untagged traffic. A trunk port carries traffic for multiple VLANs using 802.1Q tagging. Trunks are used between switches and to routers for inter-VLAN routing.

How long does the initial setup take?

Physical installation and basic configuration typically take 30 to 60 minutes for a single switch, depending on your familiarity with the CLI and the number of ports/VLANs you need to configure.

Should I disable unused ports?

Yes, disabling unused ports is a good security practice because it prevents unauthorized devices from plugging into the network. Use the shutdown command on each unused port.

Related

• Battlefield 6 b36a4 Loadouts That Actually Land Shots
• Galaxy Note 7 Still in Use? What Samsung Says Now
• Sailor Piece Ascension Guide