Cisco Catalyst switch configuration in enterprise network environment
Introduction
Cisco Catalyst switches are the backbone of enterprise networks worldwide. Proper configuration is essential for optimal performance, security, and reliability. This comprehensive guide covers the fundamental configurations every network administrator should know.
Initial Setup and Basic Configuration
Console Connection
Before configuring your Catalyst switch, establish a console connection:
Required Equipment:
- Console cable (RJ45 to DB9 or USB)
- Terminal emulation software (PuTTY, SecureCRT, or HyperTerminal)
- Connection settings: 9600 baud, 8 data bits, no parity, 1 stop bit
Basic Switch Configuration
Start with these essential configuration steps:
Initial Configuration Commands:
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW-Core-01
SW-Core-01(config)# enable secret cisco123
SW-Core-01(config)# service password-encryption
SW-Core-01(config)# banner motd "Authorized Access Only"VLAN Configuration
Virtual LANs (VLANs) are essential for network segmentation and security:
Creating VLANs
SW-Core-01(config)# vlan 10
SW-Core-01(config-vlan)# name Sales
SW-Core-01(config-vlan)# exit
SW-Core-01(config)# vlan 20
SW-Core-01(config-vlan)# name Engineering
SW-Core-01(config-vlan)# exit
SW-Core-01(config)# vlan 30
SW-Core-01(config-vlan)# name GuestAssigning Ports to VLANs
SW-Core-01(config)# interface range fastethernet 0/1-10
SW-Core-01(config-if-range)# switchport mode access
SW-Core-01(config-if-range)# switchport access vlan 10
SW-Core-01(config-if-range)# exitTrunk Configuration
Trunks carry traffic for multiple VLANs between switches:
Configuring Trunk Ports:
SW-Core-01(config)# interface gigabitethernet 0/1
SW-Core-01(config-if)# switchport mode trunk
SW-Core-01(config-if)# switchport trunk allowed vlan 10,20,30
SW-Core-01(config-if)# switchport trunk native vlan 99Spanning Tree Protocol (STP)
STP prevents loops in redundant network topologies:
Rapid Spanning Tree (RSTP)
SW-Core-01(config)# spanning-tree mode rapid-pvst
SW-Core-01(config)# spanning-tree vlan 10 priority 4096PortFast Configuration
SW-Core-01(config)# interface range fa0/1-24
SW-Core-01(config-if-range)# spanning-tree portfast
SW-Core-01(config-if-range)# spanning-tree bpduguard enableSecurity Best Practices
Port Security
Implement port security to prevent unauthorized access:
SW-Core-01(config)# interface fastethernet 0/1
SW-Core-01(config-if)# switchport port-security
SW-Core-01(config-if)# switchport port-security maximum 2
SW-Core-01(config-if)# switchport port-security violation restrict
SW-Core-01(config-if)# switchport port-security mac-address stickyAccess Control Lists (ACLs)
SW-Core-01(config)# access-list 100 deny tcp any any eq 23
SW-Core-01(config)# access-list 100 permit ip any any
SW-Core-01(config)# interface vlan 10
SW-Core-01(config-if)# ip access-group 100 inManagement and Monitoring
SNMP Configuration
SW-Core-01(config)# snmp-server community public ro
SW-Core-01(config)# snmp-server community private rw
SW-Core-01(config)# snmp-server location "Data Center Rack 15"
SW-Core-01(config)# snmp-server contact "IT Support: [email protected]"Logging Configuration
SW-Core-01(config)# logging 192.168.1.100
SW-Core-01(config)# logging trap informational
SW-Core-01(config)# service timestamps log datetime msecVerification Commands
Use these commands to verify your configuration:
VLAN Verification
show vlan brief- Display VLAN summaryshow interfaces trunk- Show trunk statusshow interfaces switchport- Port configuration details
Spanning Tree Verification
show spanning-tree- STP status overviewshow spanning-tree vlan 10- VLAN-specific STPshow spanning-tree interface fa0/1- Interface STP status
Troubleshooting Tips
Common Issues and Solutions
- VLAN not working: Check port assignment and trunk configuration
- Slow convergence: Verify STP configuration and enable PortFast
- Security violations: Review port security settings and MAC address limits
- Management access issues: Verify IP configuration and ACL settings
Configuration Checklist
- Set hostname and enable password
- Configure management VLAN and IP address
- Create and assign VLANs to ports
- Configure trunk ports for inter-switch connectivity
- Enable spanning tree protocol
- Implement port security measures
- Configure SNMP and logging
- Save configuration to startup-config
