Lab - Basic Switch Configuration

Topology

Addressing Table
Device Interface IP Address / Prefix

S1 VLAN 99 192.168.1.2 /24

S1 VLAN 99
2001:db8:acad:1::2 /64

S1 VLAN 99
fe80::2
PC-A NIC 192.168.1.10 /24

PC-A NIC
2001:db8:acad:1::10 /64

Objectives
Part 1: Cable the Network and Verify the Default Switch Configuration
Part 2: Configure Basic Network Device Settings
• Configure basic switch settings.
• Configure the PC IP address.
Part 3: Verify and Test Network Connectivity
• Display device configuration.
• Test end-to-end connectivity with ping.
• Test remote management capabilities with Telnet et SSH.
Part 4: Manage the MAC Address Table
• Record the MAC address of the host.
• Determine the MAC addresses that the switch has learned.
• List the show mac address-table command options.
• Set up a static MAC address.

Background / Scenario
Cisco switches can be configured with a special IP address known as the switch virtual interface (SVI). The
SVI, or management address, can be used for remote access to the switch to display or configure settings. If
the VLAN 1 SVI is assigned an IP address, by default all ports in VLAN 1 have access to the SVI IP address.

© 2013 - 2023 Cisco: www.netacad.com Page 1 of 12

Lab - Basic Switch Configuration

In this lab, you will build a simple topology using Ethernet LAN cabling and access a Cisco switch using the
console and remote access methods. You will examine default switch configurations before configuring basic
switch settings. These basic switch settings include device name, interface description, local passwords,
message of the day (MOTD) banner, IP addressing, and static MAC address. You will also demonstrate the
use of a management IP address for remote switch management. The topology consists of one switch and one
host using only Ethernet and console ports.
Note: The switches used are Cisco Catalyst 2960s with Cisco IOS Release 15.2(2) (lanbasek9 image). Other
switches and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands
available and output produced might vary from what is shown in the labs.
Note: Make sure that the switches have been erased and have no startup configurations. If you are unsure,
contact your instructor. Refer to Appendix A for the procedures to initialize and reload a switch.
Close configuration window

Required Resources
• 1 Switch (Cisco 2960 with Cisco IOS Release 15.2(2) lanbasek9 image or comparable)
• 1 PC (Windows with terminal emulation program, such as Tera Term)
• 1 Console cable to configure the Cisco IOS device via the console port
• 1 Ethernet cable as shown in the topology

Part 1: Cable the Network and Verify the Default Switch Configuration
In Part 1, you will set up the network topology and verify default switch settings.

Step 1: Cable the network as shown in the topology.

a. Connect the console cable as shown in the topology. Do not connect the PC-A Ethernet cable at this time.
b. Connect to the switch from PC-A using Tera Term or other terminal emulation program.
Question:

Why must you use a console connection to initially configure the switch? Why is it not possible to connect
to the switch via Telnet or SSH?

Type your answers here.

Step 2: Verify the default switch configuration.

In this step, you will examine the default switch settings, such as current switch configuration, IOS information,
interface properties, VLAN information, and flash memory.
You can access all the switch IOS commands in privileged EXEC mode. Access to privileged EXEC mode
should be restricted by password protection to prevent unauthorized use because it provides direct access to
global configuration mode and commands used to configure operating parameters. You will set passwords later
in this lab.
The privileged EXEC mode command set includes those commands contained in user EXEC mode, as well as
the configure command through which access to the remaining command modes is gained. Use the enable
command to enter privileged EXEC mode.
a. Assuming the switch had no configuration file stored in nonvolatile random-access memory (NVRAM), A
console connection using Tera Term or other terminal emulation program will place you at the user EXEC
mode prompt on the switch with a prompt of Switch>. Use the enable command to enter privileged EXEC
mode.
Open configuration window

Switch> enable
Switch#

© 2013 - 2023 Cisco: www.netacad.com Page 2 of 12

Lab - Basic Switch Configuration

Notice that the prompt changed in the configuration to reflect privileged EXEC mode.
Verify that there is a clean default configuration file on the switch by issuing the show running-config
privileged EXEC mode command. If a configuration file was previously saved, it must be removed.
Depending on the switch model and IOS version, your configuration may look slightly different. However,
there should be no configured passwords or IP address. If your switch does not have a default configuration,
erase and reload the switch.
b. Examine the current running configuration file.
Switch# show running-config
Questions:

How many FastEthernet interfaces does a 2960 switch have?

Type your answers here.
How many Gigabit Ethernet interfaces does a 2960 switch have?
Type your answers here.
What is the range of values shown for the vty lines?
Type your answers here.
c. Examine the startup configuration file in NVRAM.
Switch# show startup-config
startup-config is not present
Question:

Why does this message appear?

Type your answers here.

d. Examine the characteristics of the SVI for VLAN 1.

Switch# show interface vlan1
Switch# configure terminal
Switch(config)# interface vlan1
Switch(config-if)# no shutdown
Questions:

Is there an IP address assigned to VLAN 1?

Type your answers here.

What is the MAC address of this SVI? Answers will vary.

Type your answers here.

Is this interface up?

Ty

pe your answers here.

© 2013 - 2023 Cisco: www.netacad.com Page 3 of 12

Lab - Basic Switch Configuration

e. Examine the IP properties of the SVI VLAN 1.

Switch# show ip interface vlan1
Question:

What output do you see?

f. Connect an Ethernet cable from PC-A to port 6 on the switch and examine the IP properties of the SVI
VLAN 1. Allow time for the switch and PC to negotiate duplex and speed parameters.
Switch# show ip interface vlan1
Question:

What output do you see?

Type your answers here.

g. Examine the Cisco IOS version information of the switch.

Switch# show version
Questions:

What is the Cisco IOS version that the switch is running?

Type your answers here.

What is the system image filename?

Type your answers here.

What is the base MAC address of this switch?

Type your answers here.

h. Examine the default properties of the FastEthernet interface used by PC-A.
Switch# show interface f0/6
Question:

Is the interface up or down?

Type your answers here.

What is the speed and duplex setting of the interface?

Type your answers here.

i. Examine the default VLAN settings of the switch.
Switch# show vlan
Question:

What is the default name of VLAN 1?

Type your answers here.

Which ports are in VLAN 1?
Type your answers here.

© 2013 - 2023 Cisco: www.netacad.com Page 4 of 12

Lab - Basic Switch Configuration

Is VLAN 1 active?
Type you
r answers here.
What type of VLAN is the default VLAN?
Type your answers here.

j. Examine flash memory.

Issue one of the following commands to examine the contents of the flash directory.
Switch# show flash:
Switch# dir flash:
Files have a file extension, such as .bin, at the end of the filename. Directories do not have a file extension.
Question:

What is the filename of the Cisco IOS image?

Type your answers here.

Part 2: Configure Basic Network Device Settings

In Part 2, you will configure basic settings for the switch and PC.

Step 1: Configure basic switch settings.

a. Copy the following basic configuration and paste it into S1 while in global configuration mode.
no ip domain-lookup
hostname S1
service password-encryption
enable secret class
banner motd #
Unauthorized access is strictly prohibited. #

b. Set the SVI IP address of the switch. This allows remote management of the switch.
Before you can manage S1 remotely from PC-A, you must assign the switch an IP address. The default
configuration on the switch is to have the management of the switch controlled through VLAN 1. However,
a best practice for basic switch configuration is to change the management VLAN to a VLAN other than
VLAN 1.
For management purposes, use VLAN 99. The selection of VLAN 99 is arbitrary and in no way implies that
you should always use VLAN 99.
First, create the new VLAN 99 on the switch. Then set the IP address of the switch to 192.168.1.2 with a
subnet mask of 255.255.255.0 on the internal virtual interface VLAN 99. IPv6 address can also be
configured on the SVI interface. Use the IPv6 addresses listed in the Addressing Table.
S1# configure terminal
S1(config)# vlan 99
S1(config-vlan)# exit
S1(config)# interface vlan99
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan99, changed state to down
S1(config-if)# ip address 192.168.1.2 255.255.255.0

© 2013 - 2023 Cisco: www.netacad.com Page 5 of 12

Lab - Basic Switch Configuration

S1(config-if)# ipv6 address 2001:db8:acad:1::2/64

S1(config-if)# ipv6 address fe80::2 link-local
S1(config-if)# no shutdown
S1(config-if)# exit
Notice that the VLAN 99 interface is in the down state even though you entered the no shutdown
command. The interface is currently down because no switch ports are assigned to VLAN 99.
c. Assign all user ports to VLAN 99.
S1(config)# interface range f0/1–24,g0/1-2
S1(config-if-range)# switchport access vlan 99
S1(config-if-range)# exit
S1(config)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan99, changed state to up
To establish connectivity between the host and the switch, the ports used by the host must be in the same
VLAN as the switch. Notice in the above output that the VLAN 1 interface goes down because none of the
ports are assigned to VLAN 1. After a few seconds, VLAN 99 comes up because at least one active port
(F0/6 with PC-A attached) is now assigned to VLAN 99.
d. Issue the show vlan brief command to verify that all ports are in VLAN 99.
S1# show vlan brief

e. Configure the default gateway for S1. If no default gateway is set, the switch cannot be managed from a
remote network that is more than one router away. Although this activity does not include an external IP
gateway, assume that you will eventually connect the LAN to a router for external access. Assuming that
the LAN interface on the router is 192.168.1.1, set the default gateway for the switch.
S1(config)# ip default-gateway 192.168.1.1
f. Console port access should also be restricted with a password. Use cisco as the console login password
in this activity. The default configuration is to allow all console connections with no password needed. To
prevent console messages from interrupting commands, use the logging synchronous option.
S1(config)# line con 0
S1(config-line)# logging synchronous
S1(config-line)# password cisco
S1(config-line)# login
S1(config-line)# exit
g. Configure the virtual terminal (vty) lines for the switch to allow telnet access. If you do not configure a vty
password, you will not be able to telnet to the switch.
S1(config)# line vty 0 15
S1(config-line)# password cisco
S1(config-line)# login
S1(config-line)# end
S1#
Question:

Why is the login command required?

Type your answers here.

Close configuration window

© 2013 - 2023 Cisco: www.netacad.com Page 6 of 12

Lab - Basic Switch Configuration

Step 2: Configure an IP address on PC-A.

Assign the IP address and subnet mask to the PC as shown in the Addressing Table. An abbreviated version
of the procedure is described here. A default gateway is not required for this topology; however, you can enter
192.168.1.1 and fe80::1 to simulate a router attached to S1.

Part 3: Verify and Test Network Connectivity

In Part 3, you will verify and document the switch configuration, test end-to-end connectivity between PC-A and
S1, and test the switch’s remote management capability.

Step 1: Display the switch configuration.

Use the console connection on PC-A to display and verify the switch configuration. The show run command
displays the entire running configuration, one page at a time. Use the spacebar to advance paging.
a. A sample configuration is shown here. The settings you configured are highlighted in yellow. The other
configuration settings are IOS defaults.
Open configuration window

S1# show run

Building configuration...

Current configuration : 2206 bytes

!
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname S1
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$mtvC$6NC.1VKr3p6bj7YGE.jNg0
!
no aaa new-model
system mtu routing 1500
!
!
no ip domain-lookup
!
<output omitted>
!
interface FastEthernet0/24
switchport access vlan 99
!
interface GigabitEthernet0/1
switchport access vlan 99
!
interface GigabitEthernet0/2

© 2013 - 2023 Cisco: www.netacad.com Page 7 of 12

Lab - Basic Switch Configuration

switchport access vlan 99

!
interface Vlan1
no ip address
no ip route-cache
!
interface Vlan99
ip address 192.168.1.2 255.255.255.0
ipv6 address FE80::2 link-local
ipv6 address 2001:DB8:ACAD:1::2/64
!
ip default-gateway 192.168.1.1
ip http server
ip http secure-server
!
banner motd ^C
Unauthorized access is strictly prohibited. ^C
!
line con 0
password 7 00071A150754
logging synchronous
login
line vty 0 4
password 7 121A0C041104
login
line vty 5 15
password 7 121A0C041104
login
!
End

b. Verify the management VLAN 99 settings.

S1# show interface vlan 99
Questions:

What is the bandwidth on this interface?

Type your answers here.

What is the VLAN 99 state?

Type your answers here.

What is the line protocol state?

Type your answers here.

Close configuration window

© 2013 - 2023 Cisco: www.netacad.com Page 8 of 12

Lab - Basic Switch Configuration

Step 2: Test end-to-end connectivity with ping.

a. From the command prompt on PC-A, ping the address of PC-A first.
C:\> ping 192.168.1.10
C:\> ping 2001:db8:acad:1::10

b. From the command prompt on PC-A, ping the SVI management address of S1.
C:\> ping 192.168.1.2
C:\> ping 2001:db8:acad:1::2

Because PC-A needs to resolve the MAC address of S1 through ARP, the first packet may time out. If ping
results continue to be unsuccessful, troubleshoot the basic device configurations. Check both the physical
cabling and logical addressing.

Step 3: Test and verify remote management of S1.

You will now use Telnet to remotely access the switch. In this lab, PC-A and S1 reside side by side. In a
production network, the switch could be in a wiring closet on the top floor while your management PC is located
on the ground floor. In this step, you will use Telnet to remotely access switch S1 using its SVI management
address. Telnet is not a secure protocol; however, you will use it to test remote access. With Telnet, all
information, including passwords and commands, are sent across the session in plain text. In subsequent labs,
you will use SSH to remotely access network devices.
a. Open the Telnet Term or other terminal emulation program with Telnet capability on PC-A.
b. Select the Telnet server and provide the SVI management address to connect to S1. The password is
cisco.
c. After entering the password cisco, you will be at the user EXEC mode prompt. Access privileged EXEC
mode using the enable command and providing the secret password class.
d. Save the configuration.
S1# copy running-config startup-config
Destination filename [startup-config]? [Enter]
Building configuration...
[OK]

e. Type exit to end the Telnet session.

Step 4: Configuring SSH.

Before configuring SSH, the switch must be minimally configured with a unique hostname and the correct
network connectivity settings.
a. Verify SSH support: Use the show ip ssh command to verify that the switch supports SSH. If the switch is
not running an IOS that supports cryptographic features, this command is unrecognized.
b. Configure the IP domain: Configure the IP domain name of the network using the ip domain-name
domain-name global configuration mode command. In this lab, the domain-name value is cisco.com.
c. Generate RSA key pairs: Generating an RSA key pair automatically enables SSH. Use the crypto key
generate rsa global configuration mode command to enable the SSH server on the switch and generate an
RSA key pair. When generating RSA keys, the administrator is prompted to enter a modulus length. The
sample configuration in the figure uses a modulus size of 1,024 bits. A longer modulus length is more secure,
but it takes longer to generate and to use.

© 2013 - 2023 Cisco: www.netacad.com Page 9 of 12

Lab - Basic Switch Configuration

d. Configure user authentication: The SSH server can authenticate users locally or using an authentication
server. To use the local authentication method, create a username and password pair using the username
username secret password global configuration mode command. In this lab, the user admin is assigned the
password ccna.
e. Configure the vty lines: Enable the SSH protocol on the vty lines by using the transport input ssh line
configuration mode command. Use the line vty global configuration mode command and then the login local
line configuration mode command to require local authentication for SSH connections from the local
username database.
f. Enable SSH version 2: By default, SSH supports both versions 1 and 2. When supporting both versions,
this is shown in the show ip ssh output as supporting version 2. Enable SSH version using the ip ssh version
2 global configuration command.
g. From a SSH Client on the PCA, try to connect to the S1 by SSH protocol.

Part 4: Manage the MAC Address Table

In Part 4, you will determine the MAC addresses that the switch has learned, set up a static MAC address on
one interface of the switch, and then remove the static MAC address from that interface.

Step 1: Record the MAC address of the host.

Open a command prompt on PC-A and issue the ipconfig /all command to determine and record the Layer 2
(physical) addresses of the NIC.

e your answers here.

Step 2: Determine the MAC addresses that the switch has learned.
Open configuration window

Display the MAC addresses using the show mac address-table command.
S1# show mac address-table
Questions:

How many dynamic addresses are there?

Type your answers here.

How many MAC addresses are there in total?

Type your answers here.

Does the dynamic MAC address match the MAC address of PC-A?
e your answers here.

Step 3: List the show mac address-table options.

a. Display the MAC address table options.
S1# show mac address-table ?
Question:

How many options are available for the show mac address-table command?
Type your answers here.

© 2013 - 2023 Cisco: www.netacad.com Page 10 of 12

Lab - Basic Switch Configuration

b. Issue the show mac address-table dynamic command to display only the MAC addresses that were
learned dynamically.
S1# show mac address-table dynamic
Question:

How many dynamic addresses are there?

Type your answers here.

c. View the MAC address entry for PC-A. The MAC address formatting for the command is xxxx.xxxx.xxxx.
S1# show mac address-table address <PC-A MAC here>

Step 4: Set up a static MAC address.

a. Clear the MAC address table.
To remove the existing MAC addresses, use the clear mac address-table dynamic command in privileged
EXEC mode.
S1# clear mac address-table dynamic
b. Verify that the MAC address table was cleared.
S1# show mac address-table
Question:

How many static MAC addresses are there?

Type your answers here.

How many dynamic addresses are there?

Type your answers here.

c. Examine the MAC table again.
More than likely, an application running on your PC has already sent a frame out the NIC to S1. Look at the
MAC address table again in privileged EXEC mode to see if S1 has relearned the MAC address of PC-A.
S1# ping 192.168.1.10
S1# show mac address-table
Questions:

How many dynamic addresses are there?

Type your answers here.

Why did this change from the last display?

Type your answers here.

If S1 has not yet relearned the MAC address for PC-A, ping the VLAN 99 IP address of the switch from PC-
A, and then repeat the show mac address-table command.
d. To specify which ports a host can connect to, one option is to create a static mapping of the host MAC
address to a port.
Set up a static MAC address on F0/6 using the address that was recorded for PC-A in Part 4, Step 1. The
MAC address 0050.56BE.6C89 is used as an example only. You must use the MAC address of PC-A,
which is different than the one given here as an example.

© 2013 - 2023 Cisco: www.netacad.com Page 11 of 12

Lab - Basic Switch Configuration

S1(config)# mac address-table static 0050.56BE.6C89 vlan 99 interface

fastethernet 0/6
e. Verify the MAC address table entries.
S1# show mac address-table
Questions:

How many total MAC addresses are there?

Type your answers here.

How many static addresses are there?

Type your answers here.

f. Remove the static MAC entry. Enter global configuration mode and remove the command by putting a no
in front of the command string.
Note: The MAC address 0050.56BE.6C89 is used in the example only. Use the MAC address for PC-A.
S1(config)# no mac address-table static 0050.56BE.6C89 vlan 99 interface
fastethernet 0/6
g. Verify that the static MAC address has been cleared.
S1# show mac address-table
Question:

How many total static MAC addresses are there?

Type your answers here.

Close configuration window

Reflection Questions
1. Why should you configure the vty password for the switch?
Type your answers here.

2. Why change the default VLAN 1 to a different VLAN number?

Type your answers here.

3. How can you prevent passwords from being sent in plain text?
Type your answers here.

4. Why configure a static MAC address on a port interface?

Type your answers here.

© 2013 - 2023 Cisco: www.netacad.com Page 12 of 12