Switch Initial Configuration

Module 1: Basic Device Configuration

• The module focuses on configuring devices using security best practices.

Module Objectives

• Configure a switch with initial settings.
• Configure switch ports to meet network requirements.
• Configure secure management access on a switch.
• Configure basic router settings to route between two directly-connected networks using CLI.
• Verify connectivity between two directly connected networks.

1.1 Configure a Switch with Initial Settings

• It covers the initial configurations of a Cisco switch.

Switch Boot Sequence

• Step 1: The switch loads a power-on self-test (POST) program from ROM, checking the CPU subsystem, DRAM, and flash file system.
• Step 2: Loads the boot loader software, a small program stored in ROM that runs after POST.
• Step 3: The boot loader performs low-level CPU initialization, including initializing CPU registers for memory mapping, quantity, and speed.
• Step 4: The boot loader initializes the flash file system on the system board.
• Step 5: The boot loader locates and loads the default IOS operating system software image into memory. The switch gives control over to the IOS.

The boot system Command

• The switch attempts to automatically boot, using info in the BOOT environment variable. If unset, it tries to load and execute the first executable file.
• The IOS operating system initializes interfaces using Cisco IOS commands found in the startup-config file, named config.text, located in flash.
• Setting the BOOT environment variable requires the boot system global configuration mode command specifying the IOS location. show boot displays the current IOS boot file.

Switch LED Indicators

• SYST: Shows the system's power and functioning status.
• RPS: Indicates the Redundant Power Supply status.
• STAT (Port Status): Port status mode (default). The light shows the light status by port.
• DUPLX (Port Duplex): Indicates port duplex mode selected. The light shows the duplex mode per port.
• SPEED (Port Speed): Indicates port speed mode selected. The light indicates the speed per port.
• PoE (Power over Ethernet): Indicates PoE status if the switch supports PoE.
• The Mode button changes modes: STAT, DUPLX, SPEED, and PoE.

Switch LED Indicators (Cont.)

• RPS Off, means no RPS is ready. RPS green means RPS is ready. RPS blinking green means RPS is up but unavailable. RPS amber implies standby or fault. RPS blinking amber is internal PS failed with RPS providing power.
• PoE off is not selected or there are no issues. PoE green is selected. PoE disabled is amber. PoE is off due to fault in amber blinking state. PoE is denied due to over budget in the case of alternating green and amber.
• STAT green means Link Up. STAT amber is port blocked preventing loop. STAT alternating green/amber mean link fault.
• DUPLX green is full-duplex while amber means port blocked preventing loop.
• Speed, Off equals 10Mbps, Green equals 100Mbps and Blinking Green means 1000Mbps.

Recovering from a System Crash

• The boot loader provides switch access if the OS is unusable, due to missing/damaged files.
• Access to files in flash memory are available with the boot loader command line through a console connection.
• Step 1: Connect a PC to the switch console port via console cable, and configure terminal emulation software.
• Step 2: Unplug the switch power cord.
• Step 3: Reconnect power while holding the Mode button for 15 seconds; System LED flashes green.
• Step 4: Hold Mode, until the System LED briefly turns amber, then solid green, release Mode.
• Step 5: The boot loader switch: prompt appears.
• The boot loader command line, supports re-installing the OS or a lost password.

Switch Management Access

• Remote switch management needs IP address and subnet mask configuration.
• Remote network switch management needs a default gateway.
• The switch virtual interface (SVI) should be assigned an IP address.
• The SVI is a virtual interface, not a physical port.
• A console cable configures the device initially.

Switch SVI Configuration Example

• Switches are configured to have management controlled through VLAN 1 by default where all ports are assigned to VLAN 1 by default.
• As a security practice you should not use VLAN 1 for management.
• Configure the Management Interface by applying an IPv4 address and a subnet mask is applied to the management SVI of the switch.
• SVI for VLAN 99 will not appear until VLAN 99 exists and there is a connected device on it's switch port.
• Switches may need IPv6 config with sdm prefer dual-ipv4-and-ipv6 default, then reload.

Switch SVI Configuration Example (Cont.)

• Commands
• Enter global configuration mode with configure terminal
• Enter the interface configuration mode for the SVI with: interface vlan 99
• Apply the IPv4 address: ip address 172.17.99.11 255.255.255.0
• Apply the IPv6 address: ipv6 address 2001:db8:acad:99::1/64
• Enable the SVI: no shutdown
• Return to privileged EXEC mode: end
• Save the running config: copy running-config startup-config

Switch SVI Configuration Example (Cont.)

• Switches MUST be configured with a default gateway if it will be managed remotely from networks that are not directly connected.
• Switches do not require IPv6 default gateway when default information comes via a router advertisement (RA).
• Configure the default gatway by entering global configuration mode with: configure terminal
• Configure default gateway with ip default-gateway 172.17.99.1
• Exit the configuration mode with end

Switch SVI Configuration Example (Cont.)

• Useful commands to determine the status of virtual and physical interfaces are the show ip interface brief and show ipv6 interface brief.
• The output confirms Interface VLAN 99 is configured with IPv4 and IPv6.
• Note: Applying an IP address to the SVI is only for remote management access. This alone will not allow it to route layer 3 packets.

1.2 Configure Switch Ports

• It covers the configuration of switch ports.

Duplex Communication

• Full-duplex communication boosts bandwidth by allowing simultaneous data TX/RX, and avoids the collisions of half-duplex.
• A switch port in full-duplex mode with one device connected creates a microsegmented LAN without collisions.
• Full-duplex mode: collision detection is disabled, 100% efficiency in both directions, doubling available bandwidth.

Configure Switch Ports at the Physical Layer

• Switch ports have configurable duplex/speed settings via duplex and speed commands.
• Default duplex/speed setting for Cisco Catalyst 2960/3560 switches is auto (10/100/1000 ports will operate in either half or full duplex).
• Use autonegotiation for unknown/changing device settings on the port. Manually set the speed and duplex for servers, dedicated workstations, and network devices.
• Mismatched duplex/speed leads to connectivity issues. Autonegotiation failure leads to mismatched setting.
• Fiber-optic ports work at one preset speed as full-duplex.

Configure Switch Ports at the Physical Layer (Cont.)

• Examples of tasks
• Enter global configuration mode with configure terminal
• Enter interface configuration mode with interface FastEthernet 0/1
• COnfigure the interface duplex with duplex full
• Configure the interface speed with speed 100
• Return to the privileged EXEC mode with end

Auto-MDIX

• Auto-MDIX detects the cable connection type and configures the connection appropriately.
• Straight-through cables connect switches without Auto-MDIX to devices like servers, workstations, or routers; crossover cables connect to other switches or repeaters.
• Enable auto-MDIX with the mdix auto command, with interface speed & duplex needs to be set autimatically for feature to work right.
• Auto-MDIX is default on Catalyst 2960/3560, and older Catalyst 2950/3550 switches do not have Auto-MDIX.
• Commands include: show controllers ethernet-controller

Switch Verification Commands

• Commands
• Display interface status and configuration with show interfaces [interface-id]
• Display current startup confiuration with show startup-config
• Display current running configuration with show running-config
• Display information about flash filesystem with show flash
• Display system hardware and software status with show version
• Display a history of commands entered with show history
• Display IP info with show ip interface [interface-id]
• Display MAC address table with show mac-address-table

Verify Switch Port Configuration

• The show running-config command checks switch configuration for correctness.
• Check if the Fast Ethernet 0/18 interface is configured with the management VLAN 99. Check if the VLAN 99 is configured with the IPv4 address and whether the default gateway is properly set.

Verify Switch Port Configuration (Cont.)

• Use show interfaces shows status/statistics of switch network interfaces.
• First output line of show interface is the FastEtherNet 0/18 meaning the interface is operational. The duplex is shown as being full and the speed is 100 Mbps.

Network Access Layer Issues

• The output line shows information of show interfaces can be used to detect media issues.
• Possible fixes:
• Issue exists where interface is up and line protocol is down.
• problem exists when both protocol and interface is down
• interface has been disabled when administratively down

Network Access Layer Issues (Cont.)

• Common media errors diagnosable with show interfaces include Input Errors (runts/giants/CRC, no buffer and so on) and CRC errors are indicated when the calculated checksum doesn't equal the expected.

Interface Input and Output Errors

• A summary of all errors in datagrams received on an interface are "Input errors" that the show interfaces shows.
• The show interfaces output include: runt frames, giant frames and CRC errors, along with other errors.

Interface Input and Output Errors (Cont.)

• "Output errors" is total errors, which prevented final datagram transmission via the inspected interface and can be shown with show interfaces.
• Collisions occur in half-duplex operations, with no collisions with full-duplex communication.
• Late collisions happen when collisions occur after 512 frame bits have been transmitted. Excessive is the cables cause, incorrect misconfiguration.

Troubleshooting Network Access Layer Issues

• Troubleshooting steps involving switch and another devices, include show interfaces command to check interface.
• Then, check EMI, Duplex and Cables.

1.3 Secure Remote Access

• This discusses ways of securing remote access to network devices.

Telnet Operation

• Telnet uses TCP port 23.
• Username and password are sent plain text unencrypted
• Attacker can monitor capture using Wireshark
• User admin and password CCNA can be captured during Telnet session.

SSH Operation

• Secure Shell (SSH) is a type of secure that uses TCP port 22 which provides encrypted remote management.
• Replace it with Telnet for management connections.
• Session can be tracked via IP, credentials are encrypted (unlike Telnet).

Verify the Switch Supports SSH

• To enable SSH, a Catalyst 2960 switch needs a version of the IOS software with cryptographic features and capabilities.
• show version to check the switch's IOS. An "k9" in the IOS filename indicates that the switch contains cryptographic (encrypted) features and capabilities .

Configure SSH

• Before SSH config, the switch hostname must be unique with network connectivity.
• Step 1: Verify SSH support with with: show ip ssh
• Step 2: Configure the IP domain with ip domain-name domain-name
• Step 3: Generate RSA key pairs with crypto key generate rsa to enable server. Delete wiht: crypto key zeroize rsa`.
• Step 4: Configure user authentication to use the local authentication with username and password: username username secret password
• Step 5: Configure the vty lines and enable the SSH protocol with with: transport input sshand locally with: login local line
• Step 6: Enable SSH version 2 with ip ssh version 2

Verify SSH is Operational

• Third party SSH clients, such as PuTTY, should be used to an SSH server such as that configured on the Cisco device.
• Verify that show ip ssh confirms the operation to be enabled.

1.4 Basic Router Configuration

Configure Basic Router Settings

• Configure the basic router or switches settings so that they can have a similar operational set. Commands:
• hostname R1 where the hostname is assigned
• enable secret class enable a secure password
• Access through enable secret and line.
• Configuring a banner that notifies access.

Configure Basic Router Settings (Cont.)

• Set a banner by entering configuration mode and typing `banner motd $ Authorized Access Only! $
• Enable all modes and save changes.

Basic Router Configuration

• The topology uses a stack to configure IPv6 and IPv4 interfaces.

Configure Router Interfaces

• Routers use LAN and WAN interfaces to support network connections of different types.
• Available interfaces MUST be a global address.

Configure Router Interfaces (Cont.)

• Command to configure interface:
• interface gigabitethernet 0/0/0
• After entering configuration mode, assign the IP address, IPv6 address and description. If appropriate, shut it down.

IPv4 Loopback Interfaces

• A common configuration of the Cisco IOS is to enable the loopback interface
• Loopback interface is a network interface that is local to the router.
• Commands
• Router(config)# interface loopback number -Router(config-if)# ip address ip-address subnet-mask

1.5 Verify Directly Connected Networks

Interface Verification Commands

• To identify interface commands, useful steps are show ip interface brief where a summary with the IPv4 and IPv6 is displayed
• Commands can be applied to the specified interface.

Verify Interface Status

• show ip interface brief is used to identify the status.
• They can be used together to see that interfaces are correctly configured.

Verify IPv6 Link Local and Multicast Addresses

• Output of the show ipv6 interface brief displays IPv6 address. One addess is the IPv6 global unicast address.
• Show IPv6 interface displays the multicast addresses.

Verify Interface Configuration

• The current config can be looked at by running command show.
• The show interfaces command can be more detailed and show information.

Verify Routes

• Show how "show ip routes and IPV6" commands
• Can verify interfaces.

Filter Show Command Output

• Terminal length command specifies lines displayed and a value of 0 prevents a router from pausing at line screens.
• Commands can be filtered.

Command History Feature

• A listing of the executed commands can be accessed to be recalled.

What Did I Learn In This Module?

• Five step boot
• Use LEDs to monitor switch performances such as SYST, RPX, STAT and POE.
• Setup remote management with ip address and subnet mask.

What Did I Learn In This Module? (Cont.)

• Commands that can be used when verifying switch configurations include TELNET to verify switch.
• To configure SSH, verify that commands such as username, password and enable secret must be secured by SSH on devices.

What Did I Learn In This Module? (Cont.)

• One feature between switches
• Routers can interconnect devices so they both must be up to see interfaces.
• Commands - List current status, check history and view the list.

Module 1: Basic Device Configuration

• New Terms and Commands
  • boot system flash
  • Power over Ethernet (PoE)
  • duplex
  • speed
  • auto-mdix
  • show controllers ethernet controller X phy
  • show flash
  • show history
  • show ip ssh
  • ip ssh version 2
  • Loopback Interface
  • interface loopback x
  • include
  • exclude
  • section
  • show history
  • terminal history size

Learn how to configure a Cisco switch with initial settings. Understand the switch boot sequence, and configure the hostname. Practice security best practices for device configuration.