Featured image

Table of Contents Link to heading

This guide covers Cisco IOS switch configuration from initial console access through to a production-hardened state. Each section pairs the configuration commands with a verification step — in operational environments, the verify commands are as important as the config commands. An unchecked config is an assumption.

Warning
All passwords, community strings, and keys in this guide are illustrative placeholders. Use credentials that meet your organisation’s security policy, manage them in a secrets store (Ansible Vault, HashiCorp Vault), and never commit them to version control.

Console Access and CLI Entry Points Link to heading

Step-by-Step Process Link to heading

  • Connect a console cable (RJ45-to-DB9 or USB-to-Serial) from your laptop to the switch’s console port.
  • Open a terminal emulator (PuTTY, Tera Term, SecureCRT) with the following serial parameters: 
    Baud rate: 9600
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None
  • Press Enter after the connection opens to get a prompt.

Access the Switch CLI Link to heading

  • Press Enter to enter User EXEC mode (> prompt).
  • Type enable to enter Privileged EXEC mode (# prompt).

Verify Console Connection Link to heading 

show version
show running-config

Confirm the switch model, IOS version, and that the running config is a clean baseline before making changes.

Baseline Hardening: Hostname, Passwords, and Unused Port Shutdown Link to heading

Set a Hostname Link to heading 

configure terminal
hostname MySwitch
exit

Verify Hostname Link to heading 

show running-config | include hostname

Secure Console Access Link to heading

Note
An unsecured console port is a physical access risk — anyone with a cable can reach the CLI without authentication. Set a console password on every device, even in lab environments. The habit matters more than the specific threat model.
configure terminal
line console 0
password Cisco123
login
exit

Verify Console Security Link to heading 

show running-config | section line console

Secure VTY Lines (Remote Access via SSH/Telnet) Link to heading 

configure terminal
line vty 0 4
password RemotePass
login
exit
Warning
The above configures VTY with a shared line password supporting both Telnet and SSH. This is a starting point only — complete the SSH configuration section below to restrict VTY to SSH-only (transport input ssh) with per-user authentication via login local. Telnet transmits credentials in cleartext and should be disabled on all production devices.

Verify VTY Security Link to heading 

show running-config | section line vty

Create a Strong Enable Password Link to heading 

configure terminal
enable secret SuperSecurePassword
exit

enable secret stores a salted MD5 hash. Never use enable password — it stores credentials in plaintext in the running config, visible to anyone who can view it.

Verify Enable Password Link to heading 

show running-config | include enable secret

Disable Unused Ports (Security Best Practice) Link to heading

Unused switch ports left in the default no shutdown state are an access risk — any device connected to them gets network access without authentication (before 802.1X is deployed). Administratively shut down all ports that are not in active use.

configure terminal
interface range GigabitEthernet0/2 - 0/24
shutdown
exit

Verify Port Shutdown Link to heading 

show interfaces status

All unused ports should show disabled in the status column.

VLAN Creation, Port Assignment, and Trunk Configuration Link to heading

Creating VLANs and Assigning Ports Link to heading 

configure terminal
vlan 10
name Management_VLAN
vlan 20
name Sales_VLAN
exit

Verify VLAN Creation Link to heading 

show vlan brief

Confirm VLANs are present and active. VLANs in act/lshut state have no active ports assigned — this is expected until ports are assigned below.

Assign VLANs to Specific Ports Link to heading 

configure terminal
interface GigabitEthernet0/1
switchport mode access
switchport access vlan 10
exit
interface GigabitEthernet0/2
switchport mode access
switchport access vlan 20
exit

Verify VLAN Assignment Link to heading 

show interfaces GigabitEthernet0/1 switchport
show interfaces GigabitEthernet0/2 switchport

Confirm Access Mode VLAN matches the intended VLAN for each port.

Configure the Trunk Port (For Inter-VLAN Communication) Link to heading

Trunk ports carry tagged traffic for multiple VLANs between switches or to a router performing inter-VLAN routing. Explicitly define which VLANs are allowed on the trunk — permitting all VLANs by default means any new VLAN added to the switch will automatically traverse the trunk, which is rarely the intended behaviour.

configure terminal
interface GigabitEthernet0/24
switchport mode trunk
switchport trunk allowed vlan 10,20
exit

Verify Trunk Configuration Link to heading 

show interfaces GigabitEthernet0/24 trunk

Confirm the allowed VLAN list matches your intent and that the native VLAN is consistent on both ends of the trunk.

Warning
Mismatched native VLANs on a trunk (e.g., VLAN 1 on one end, VLAN 99 on the other) cause native VLAN mismatch warnings and can create unexpected traffic paths. Configure the native VLAN explicitly on both ends: switchport trunk native vlan <id>.

Management IP and Default Gateway Link to heading

Assign an IP to the VLAN Interface Link to heading 

configure terminal
interface vlan 10
ip address 192.168.1.1 255.255.255.0
no shutdown
exit

Verify IP Assignment Link to heading 

show ip interface brief

The management SVI should show up/up. An admin down state needs no shutdown; down/down indicates no active ports are assigned to that VLAN.

Configure Default Gateway Link to heading 

configure terminal
ip default-gateway 192.168.1.254
exit

Verify Default Gateway Link to heading 

show ip route

SSH Configuration for Secure Remote Management Link to heading

Generate RSA Keys for SSH Link to heading 

configure terminal
crypto key generate rsa
exit

When prompted for key modulus, specify 2048 bits minimum. Keys below 1024 bits are rejected by SSH v2; keys below 2048 bits are considered weak by current standards.

Verify RSA Key Generation Link to heading 

show crypto key mypubkey rsa

Set SSH Version Link to heading 

configure terminal
ip ssh version 2
exit

Verify SSH Version Link to heading 

show ip ssh

Define a Local Username for SSH Authentication Link to heading 

configure terminal
username admin secret SecureAdminPassword
exit

Verify Local User Link to heading 

show running-config | include username

Apply SSH Access to VTY Lines Link to heading 

configure terminal
line vty 0 4
transport input ssh
login local
exit

Verify SSH Access Link to heading 

show running-config | section line vty

transport input ssh ensures the line rejects Telnet connections entirely. login local enforces per-user authentication against the local user database rather than the shared line password.

Spanning Tree Protocol: RSTP, Root Bridge, and Edge Port Hardening Link to heading

Enable Rapid Spanning Tree Protocol (RSTP) Link to heading

RSTP (802.1w) converges in 1–2 seconds compared to Classic STP’s 30–50 seconds. There is no operational reason to run Classic STP on a new deployment.

configure terminal
spanning-tree mode rapid-pvst
exit

Verify STP Mode Link to heading 

show spanning-tree summary

Set Root Bridge Priority Link to heading

STP root bridge election defaults to the lowest bridge priority, with MAC address as a tiebreaker. Without explicit priority configuration, the root bridge is determined by an arbitrary MAC address — typically not the device best positioned to be root. Control root bridge placement explicitly.

configure terminal
spanning-tree vlan 10 priority 4096
spanning-tree vlan 20 priority 8192
exit
Tip
Use increments of 4096 (the valid step size) when setting priorities. Configure both a primary root (priority 4096) and a secondary root (priority 8192) for each VLAN on your distribution-layer switches to ensure deterministic failover when the primary goes down.

Verify Root Bridge Priority Link to heading 

show spanning-tree vlan 10
show spanning-tree vlan 20

Confirm the intended switch shows This bridge is the root for each VLAN.

Enable PortFast on Edge Ports (Prevent Slow Booting) Link to heading

PortFast bypasses the STP listening and learning states on access ports, allowing end devices to get network connectivity immediately on link up rather than waiting 30 seconds. It should only be enabled on ports connected to end devices — never on uplinks or trunk ports.

interface GigabitEthernet0/5
spanning-tree portfast
exit
Warning
Enable BPDU Guard alongside PortFast on all edge ports: spanning-tree bpduguard enable. If a switch is plugged into a PortFast port (intentionally or accidentally), BPDU Guard immediately puts the port into err-disabled state, preventing a loop from forming. PortFast without BPDU Guard is an incomplete configuration.

Verify PortFast Link to heading 

show running-config | include spanning-tree portfast

QoS for Traffic Prioritisation Link to heading

QoS ensures latency-sensitive traffic — voice, video conferencing, interactive applications — gets forwarding priority over bulk data during periods of congestion. On an access switch, QoS policy is typically applied to ingress interfaces, marking traffic as it enters the network so downstream devices can honour the markings.

Enable QoS Globally Link to heading 

mls qos

Configure Interface Trust Levels Link to heading

Trust DSCP markings from devices that set them correctly (IP phones, video endpoints). Don’t trust markings from end-user workstations — they can mark their own traffic to gain priority unfairly.

interface GigabitEthernet0/1
mls qos trust dscp
exit

Set Up Traffic Classification & Prioritisation Link to heading 

access-list 101 permit ip any any dscp ef
class-map match-any VOIP_TRAFFIC
match access-group 101
exit

policy-map QOS_POLICY
class VOIP_TRAFFIC
priority percent 30
exit

interface GigabitEthernet0/1
service-policy input QOS_POLICY
exit

For a detailed implementation guide, check out this Cisco resource.

ACLs for Inter-VLAN and Management Access Control Link to heading

ACLs on a Layer 3 switch are applied to SVI interfaces to filter routed traffic between VLANs. They operate at Layer 3 and cannot filter intra-VLAN traffic — use Private VLANs or port-level controls for that.

Example: Block Traffic from a Specific IP Range Link to heading 

access-list 102 deny ip 192.168.50.0 0.0.0.255 any
access-list 102 permit ip any any
exit

interface vlan 10
ip access-group 102 in
exit

Example: Restrict SSH Access to Trusted IPs Link to heading 

access-list 110 permit tcp 192.168.1.100 0.0.0.255 any eq 22
access-list 110 deny ip any any
exit

line vty 0 4
access-class 110 in
exit
Tip
Apply an access-class to VTY lines to restrict SSH access to your management subnet. This limits the attack surface for brute-force attempts against the management plane without requiring a separate firewall rule.

DHCP Snooping: Blocking Rogue DHCP Servers Link to heading

DHCP Snooping is a Layer 2 security feature that allows the switch to enforce which ports can respond to DHCP requests. Untrusted ports (access ports facing end devices) are blocked from sending DHCP offers — only the trusted uplink toward the authorised DHCP server can respond.

Enable DHCP Snooping Globally Link to heading 

ip dhcp snooping

Apply DHCP Snooping to VLANs Link to heading 

ip dhcp snooping vlan 10
ip dhcp snooping vlan 20

interface GigabitEthernet0/24
ip dhcp snooping trust
exit
Note
DHCP Snooping also builds a binding table (IP-to-MAC-to-port mappings) used by IP Source Guard and Dynamic ARP Inspection. Enable Snooping before enabling those features — they depend on the binding table to function correctly.

Port Security: MAC Limiting and Sticky Address Binding Link to heading

Port Security limits the number of MAC addresses that can be learned on an access port, and defines the action taken when the limit is exceeded. It’s most useful for locking down fixed workstation ports in environments where device substitution is a concern.

Example: Allow Only One MAC Per Port Link to heading 

interface GigabitEthernet0/2
switchport mode access
switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict
exit

violation restrict drops frames from violating MACs and increments a counter — the port stays up. violation shutdown puts the port into err-disabled state, requiring manual recovery or an errdisable recovery timer. Choose based on your operational preference for visibility vs. enforcement strictness.

Example: Sticky MAC Address Binding Link to heading

Sticky learning causes the switch to dynamically learn the first MAC address seen on the port and write it to the running config as a static secure address. On next reboot, that address must be in the startup config or it will be re-learned.

interface GigabitEthernet0/3
switchport mode access
switchport port-security
switchport port-security mac-address sticky
exit
Tip
After sticky addresses are learned, save the running config immediately (write memory). Sticky addresses are only in the running config until saved — a reload without saving loses the learned addresses.

EtherChannel with LACP for Link Aggregation Link to heading

EtherChannel bundles multiple physical links into a single logical interface, providing both bandwidth aggregation and link redundancy. LACP (IEEE 802.3ad) is the standards-based protocol for negotiating channel formation — prefer it over PAgP (Cisco proprietary) in multi-vendor environments.

Configure EtherChannel (LACP Mode) Link to heading 

interface Port-channel1
switchport mode trunk
exit

interface range GigabitEthernet0/10 - 0/12
channel-group 1 mode active
exit
Note
Both ends of the EtherChannel must use compatible modes: active/active or active/passive for LACP. on/on forces the channel without negotiation — use only when the remote end does not support LACP (e.g., some hypervisor vSwitch configurations). Mismatched modes (active on one end, on on the other) will cause the channel to fail to form.

SNMP for Network Monitoring Link to heading

Enable SNMP Link to heading

Warning
SNMPv1 and SNMPv2c community strings are transmitted in cleartext. Use SNMPv3 with authPriv mode (authentication + encryption) for any environment where management traffic traverses untrusted network segments. If SNMPv2c is required for compatibility, restrict access using an ACL referencing only authorised NMS hosts.
snmp-server community PublicString RO
snmp-server community PrivateString RW
snmp-server location DataCentre
snmp-server contact admin@company.com

Verify SNMP Configuration Link to heading 

show snmp community
show snmp location

NTP Time Synchronisation Link to heading

Accurate timestamps are foundational for log correlation, security event analysis, and certificate validation. Without synchronised time, correlating events across multiple devices during an incident becomes unreliable.

Configure NTP to Sync Time Link to heading 

ntp server 192.168.1.100
clock timezone UTC 0
service timestamps debug datetime msec
service timestamps log datetime msec

Verify NTP Link to heading 

show ntp status
show clock

show ntp status should show Clock is synchronised with a stratum value and reference clock. If it shows unsynchronised, check reachability to the NTP server and ensure UDP/123 is not blocked.

Centralised Logging with Syslog Link to heading

Enable Syslog Link to heading 

logging host 192.168.1.200
logging trap warnings
logging source-interface Vlan10
Tip
Set logging trap warnings (severity 4) as a minimum in production. For security-sensitive environments, consider logging trap informational (severity 6) to capture authentication events, ACL hits, and STP topology changes. Higher verbosity increases log volume — size your syslog infrastructure accordingly.

Verify Syslog Settings Link to heading 

show logging
show running-config | include logging

NetFlow for Traffic Analysis Link to heading

Enable NetFlow Link to heading 

ip flow-export destination 192.168.1.150 9996
ip flow-export version 9
ip flow-cache timeout active 5

Verify NetFlow Link to heading 

show ip flow export
show ip cache flow

NetFlow data gives you per-conversation traffic visibility — source/destination IP, port, protocol, byte count, and packet count — that SNMP interface counters alone cannot provide. It’s essential for capacity planning, anomaly detection, and forensic analysis after security incidents.

Advanced Layer 2 Security: MAC Filtering, IP Source Guard, and DAI Link to heading

Enable MAC Address Filtering (Higher Security) Link to heading 

mac address-table static 00e0.abcd.1234 vlan 10 interface GigabitEthernet0/1
mac address-table static 00e0.abcd.5678 vlan 20 interface GigabitEthernet0/2

Enable IP Source Guard (Prevent IP Spoofing) Link to heading

IP Source Guard validates the source IP address of frames against the DHCP Snooping binding table. Frames from IP addresses not in the binding table are dropped, preventing a device from spoofing another host’s IP address.

interface GigabitEthernet0/3
ip verify source
exit
Note
IP Source Guard requires DHCP Snooping to be active on the same VLAN — it uses the snooping binding table for validation. Devices with static IP addresses will be blocked unless you add static entries to the binding table: ip source binding <mac> vlan <id> <ip> interface <if>.

Enable Dynamic ARP Inspection (Mitigate ARP Attacks) Link to heading

DAI validates ARP packets against the DHCP Snooping binding table, dropping ARP replies where the sender IP/MAC pair doesn’t match a known binding. This prevents ARP cache poisoning and man-in-the-middle attacks at the access layer.

ip arp inspection vlan 10
ip arp inspection vlan 20

Verify Security Features Link to heading 

show mac address-table static
show ip verify source
show ip arp inspection

Multicast Optimisation: IGMP Snooping and PIM Sparse Mode Link to heading

Enable IGMP Snooping to Optimise Multicast Traffic Link to heading

IGMP Snooping is enabled by default on most Cisco switches. It causes the switch to inspect IGMP membership reports and limit multicast traffic to only the ports that have receivers — without it, multicast traffic floods all ports in the VLAN like broadcast traffic.

ip igmp snooping

Configure PIM Sparse Mode for Multicast Routing Link to heading 

ip multicast-routing
interface vlan 50
ip pim sparse-mode
exit

Set Up a Rendezvous Point (RP) for Multicast Traffic Link to heading 

ip pim rp-address 192.168.1.1

Verify Multicast Configuration Link to heading 

show ip pim neighbor
show ip igmp groups

For more details on multicast routing, check out this Meraki guide.

HSRP for First-Hop Gateway Redundancy Link to heading

HSRP provides a virtual gateway IP shared between two Layer 3 switches. End devices use the virtual IP as their default gateway — when the active switch fails, the standby takes over the virtual IP without requiring any reconfiguration on the end devices.

Enable HSRP on VLAN Interfaces Link to heading 

interface vlan 10
ip address 192.168.1.1 255.255.255.0
standby 1 ip 192.168.1.254
standby 1 priority 110
standby 1 preempt
exit

standby preempt ensures the higher-priority switch reclaims the active role after recovering from a failure. Without it, a recovered switch with higher priority remains in standby even after the lower-priority switch took over.

Verify HSRP Status Link to heading 

show standby

The active switch should show State is Active; the standby should show State is Standby. Confirm the virtual IP and active/standby roles match your intended topology.

Private VLANs for Intra-Subnet Isolation Link to heading

Private VLANs segment a primary VLAN into secondary VLANs that restrict lateral communication between hosts in the same IP subnet. Isolated ports can only communicate with the promiscuous port (typically the uplink or gateway); community ports can communicate with each other and the promiscuous port. This is commonly used in DMZs, hosted environments, and high-security access layers.

Create Primary & Secondary VLANs Link to heading 

vlan 100
name Primary_VLAN
vlan 101
name Isolated_VLAN
vlan 102
name Community_VLAN
exit

Assign VLAN Roles Link to heading 

interface GigabitEthernet0/5
switchport mode private-vlan host
switchport private-vlan host-association 100 101
exit

Verify Private VLAN Configuration Link to heading 

show vlan private-vlan

Storm Control for Broadcast and Multicast Flood Protection Link to heading

Storm control rate-limits broadcast, multicast, and unknown unicast traffic on an interface to prevent a traffic storm from saturating the switch fabric. When a threshold is exceeded, the configured action (drop or shutdown) is triggered.

Enable Storm Control on Interfaces Link to heading 

interface GigabitEthernet0/3
storm-control broadcast level 50.00
storm-control multicast level 50.00
storm-control action shutdown
exit
Tip
storm-control action shutdown err-disables the port when the threshold is crossed, which stops the storm but also takes the port offline. In production, consider storm-control action trap to generate an SNMP alert first, then tune thresholds based on observed traffic profiles before switching to shutdown action.

Verify Storm Control Settings Link to heading 

show storm-control

802.1X Port-Based Network Access Control Link to heading

802.1X enforces authentication before granting network access at the port level. Devices must authenticate to a RADIUS server before being placed into their access VLAN. It’s the most robust access control mechanism available at Layer 2 and is standard in enterprise environments.

Enable 802.1X Globally Link to heading 

dot1x system-auth-control

Configure Authentication on Interfaces Link to heading 

interface GigabitEthernet0/4
dot1x port-control auto
dot1x reauthentication
exit
Note
802.1X requires a RADIUS server (Cisco ISE, FreeRADIUS, or equivalent) configured as an AAA server on the switch. Configure aaa new-model, aaa authentication dot1x, and radius-server host before enabling 802.1X on interfaces, or authentication will fail and ports will remain unauthorised.

Verify 802.1X Status Link to heading 

show dot1x interface

VRRP for Multi-Vendor Gateway Redundancy Link to heading

VRRP (RFC 5798) is the open-standard equivalent of HSRP. Use it in multi-vendor environments where Cisco HSRP is not available on all devices.

Enable VRRP on VLAN Interfaces Link to heading 

interface vlan 20
ip address 192.168.2.1 255.255.255.0
vrrp 1 ip 192.168.2.254
vrrp 1 priority 120
exit

Verify VRRP Status Link to heading 

show vrrp

Saving Configuration and Backup Link to heading

Save Configuration to Startup-Config Link to heading 

write memory

or

copy running-config startup-config

Save after every configuration session. An unsaved running config is lost on reload — and unexpected reloads happen.

Verify Configuration Save Link to heading 

show startup-config

Final Steps: Review & Documentation Link to heading

  1. Backup Configuration to a TFTP/SCP Server

    copy startup-config tftp://192.168.1.250/MySwitch-backup.cfg

  2. Test Connectivity & Reachability

    ping 192.168.1.254
traceroute 8.8.8.8

  3. Document All Settings

Tip
Automate configuration backups using Ansible or AWX on a scheduled cadence rather than relying on manual TFTP copies. A backup that depends on someone remembering to run it is not a reliable backup. Store configs in a version-controlled Git repository — you get history, diff capability, and rollback for free.

Ensure VLAN assignments, trunk configurations, STP topology, and management addressing are recorded in your CMDB or network documentation system. A network topology diagram showing VLAN membership and uplink paths accelerates troubleshooting significantly when you need it under pressure.