Configuring Managed Switch Fundamentals

1. Navigating the Command Line Interface (CLI)

When you first connect via the console and press Enter, you'll see a prompt like Switch>. This is the User EXEC mode. It's a safe, limited mode for basic monitoring. To make changes, you need to elevate your privileges.

1. Privileged EXEC Mode: Type enable and press Enter. The prompt will change to Switch#. This mode gives you access to all monitoring commands and allows you to move into configuration mode.
2. Global Configuration Mode: Type configure terminal (or the shortcut conf t). The prompt will change to Switch(config)#. This is where you'll make system-wide changes.

Think of it like using sudo in Linux to gain root privileges before editing system files.

2. The Core Configuration Walkthrough

We are now going to walk through the entire initial configuration process. The following video provides an excellent, end-to-end demonstration. We'll watch it in sections, and I'll provide commentary and context for each part.

Let's break down those commands and their purpose.

Hostname and Admin Credentials

From the global configuration mode (Switch(config)#):

• hostname SW-LAB-01
  • What it does: Assigns a unique name to the switch. In a large data center, a clear naming convention (e.g., Country-Site-Row-Role-Number) is critical for identification. Notice the command prompt changes immediately to reflect the new name.
• ip domain-name mylab.local
  • What it does: Associates the switch with a domain name. This is a prerequisite for generating RSA crypto keys, which are needed for secure SSH access.
• crypto key generate rsa
  • What it does: Creates the cryptographic keys the switch will use to identify itself during an SSH session, enabling an encrypted connection. A key size of 2048 bits is a common and secure choice.
• username admin privilege 15 secret SecurePass123
  • What it does: Creates a local user account. privilege 15 grants this user full administrative rights, equivalent to being in privileged EXEC mode. Using secret ensures the password is stored in the configuration file in an encrypted format.
• enable secret AnotherSecurePass
  • What it does: Sets a password to protect access to privileged EXEC mode (enable). The secret keyword means this password will also be strongly encrypted. This is a secondary layer of security.

3. Configuring the Management IP Address

Right now, we can only manage the switch through the console cable. To manage it remotely over the network, we need to give it an IP address.

First, let's understand the two main approaches. The Cisco guide below explains the difference between in-band and out-of-band management.

• Out-of-Band (OOB): Uses a dedicated physical management port, keeping management traffic completely separate from user data traffic. This is highly secure and common in large data centers.
• In-Band: Uses a virtual interface on a VLAN to carry management traffic alongside user traffic. This is very common and what we'll configure now.

We will configure an IP address on a Switched Virtual Interface (SVI). An SVI is a logical, Layer 3 interface that you create for a specific VLAN.

Let's return to the video to see this in practice.

Here are the commands and the logic behind them:

1. Create the Management VLAN and SVI:

   • interface vlan 99
     • What it does: This single command creates both VLAN 99 and the logical SVI for that VLAN, then enters the configuration mode for that interface. It's a best practice to use a dedicated VLAN for management rather than the default VLAN 1.
   • ip address 10.30.99.2 255.255.255.0
     • What it does: Assigns the IPv4 address and subnet mask to the SVI. This is the address you will use to ping, SSH to, or otherwise manage the switch.
   • no shutdown
     • What it does: Administratively enables the interface. Note that an SVI will only become fully active (state "up/up") once a physical port is assigned to that VLAN and has an active device connected.

2. Set the Default Gateway:

   • exit (to return to global config mode)
   • ip default-gateway 10.30.99.1
     • What it does: This is crucial. It tells the switch where to send traffic destined for a different network (any IP not in the 10.30.99.0/24 subnet). Without this, you could only manage the switch from a computer on the exact same VLAN/subnet. The gateway is typically the IP address of the router for that network.

4. Saving and Verifying the Configuration

The changes you've made so far exist only in the running configuration, which is stored in the switch's volatile RAM. If the switch loses power, your configuration will be lost. You must save it to the startup configuration, stored in non-volatile NVRAM.

• From privileged EXEC mode (SW-LAB-01#), run the command:
  copy running-config startup-config
  You can also use the older command write memory.

Now, let's verify that our configuration works.

The final test is to see if we can access the switch remotely. The last part of the video demonstrates this.

This successful SSH login is the proof that all the pieces are working together: the IP address is active, the default gateway is routing traffic correctly, and the user credentials are valid.

5. Practice Application

To prepare for an interview scenario, it's vital to have these commands ready. Imagine you're given a new switch and the following requirements:

• Hostname: CORP-SW-FLR4-2
• Management VLAN: 104
• Management IP: 10.4.104.10 /24
• Default Gateway: 10.4.104.1
• Admin User: netadmin with password C1sc0!Rul3z

Starting from the Switch> prompt, write down the exact sequence of commands you would use to configure this device and save your work. This exercise will help commit the process to memory.

Conclusion

You have now performed the fundamental configuration that makes a switch a manageable and secure network device. You didn't just learn the commands; you learned why you're entering them—a key piece of knowledge for any technical role.

Key Takeaways:

• You must move from User EXEC (>) to Privileged EXEC (#) with enable, and then to Global Config ((config)#) with configure terminal to make changes.
• The initial config consists of setting a hostname, creating an enable secret and a local username with privilege 15.
• A management IP address is assigned to a Switched Virtual Interface (SVI) (interface vlan <id>).
• The ip default-gateway command is essential for remote management from different networks.
• Configuration must be saved from the running-config to the startup-config using copy run start to survive a reboot.

In our next lesson, we will expand on the concept of VLANs. You've created one for management; next, you'll learn to configure VLANs on a switch to segment user traffic and correctly configure trunk and access ports, which is the foundation of modern network design.