Step-by-Step Switch Configuration Walkthrough¶

A linear runbook for taking a switch from unknown/dirty state to a clean, working configuration — factory reset through save. Each step links to the page with full background; this page is just the sequence. For command syntax outside this flow, see the Cisco IOS CLI Reference.

Example scenario used throughout: switch SW01, VLAN 10 (Office) on most access ports, VLAN 20 (Guest) on a few, and a trunk uplink to a core switch on Gi0/48.

1. Connect & Factory Reset¶

Connect via console and start from a known-clean state — skip this step if the switch is already blank or you specifically want to keep the existing config:

enable
erase startup-config
delete vlan.dat
reload

Answer every prompt as it comes: erase startup-config asks "Continue? [confirm]", delete vlan.dat asks twice (filename, then confirm), and reload may first ask "System configuration has been modified. Save? [yes/no]" — type no (saving would restore the config you just erased) — before its final "[confirm]". The switch reboots with no saved configuration. When it comes back up it asks Would you like to enter the initial configuration dialog? [yes/no]: — type no, then press RETURN to get the Switch> prompt. See Configuration Management & Recovery for why delete vlan.dat matters — erase startup-config alone leaves old VLANs behind.

2. Set the Hostname¶

First thing after reload, so every subsequent prompt in your terminal confirms which switch you're on:

enable
conf t
hostname SW01
no ip domain-lookup

no ip domain-lookup stops IOS treating every mistyped command as a hostname to DNS-resolve — without it the console hangs ~30 seconds on each typo.

Steps 3-5 all continue in configuration mode — if you're jumping in mid-page, run conf t first.

3. Create VLANs¶

Define every VLAN you'll need before assigning any ports to them — see VLANs & Inter-VLAN Routing:

vlan 10
 name Office
vlan 20
 name Guest
vlan 999
 name UNUSED

999 is a dedicated blackhole VLAN for unused ports — see Security Hardening.

4. Configure Trunk Ports¶

Set up the uplink to the core switch/rest of the network, carrying every VLAN that needs to extend beyond this switch:

interface Gi0/48
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999
 no shutdown

Platform note: if the switch rejects switchport mode trunk with Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode, run switchport trunk encapsulation dot1q on the interface first, then retry. Older ISL-capable models (3560/3560-X, 3750/3750-X) need this; newer switches — including the 3560-CX — are 802.1Q-only and don't have the command.

See VLANs & Inter-VLAN Routing for native VLAN mismatch risks and multi-switch trunk topology.

5. Configure Access Ports¶

First park every access port shut in the blackhole VLAN, so anything you don't explicitly enable stays dark — see Disable Unused Ports:

interface range Gi0/1 - 47
 shutdown
 switchport access vlan 999

Then assign each in-use access port to the VLAN its connected device belongs to, and bring only those ports up:

interface range Gi0/1 - 40
 switchport mode access
 switchport access vlan 10
 no shutdown

interface range Gi0/41 - 47
 switchport mode access
 switchport access vlan 20
 no shutdown

Any port with nothing connected should be left out of these ranges — it stays shut in VLAN 999.

6. Save the Configuration¶

Nothing above survives a reload until it's written to NVRAM:

end
copy running-config startup-config

Verify before walking away:

Cisco IOS — privileged EXEC:

! Confirm VLANs exist and ports are assigned correctly
show vlan brief

! Confirm the ports you enabled are up and in the right VLAN
show interfaces status

! Confirm Gi0/48 is trunking with native VLAN 999 and VLANs 10,20,999 allowed
show interfaces trunk

! Spot-check the full running config
show run

7. Remote Management (Optional but Recommended)¶

Everything so far has been done over the console cable. To manage the switch over the network instead, it needs two more things:

A management IP. Give the switch an address on the management VLAN and a default gateway — the commands, and the SVI autostate trap that keeps the interface down until a live port carries the VLAN, are in Device Setup Fundamentals.

SSH. Then follow Enable SSH on a Cisco Switch — hostname and domain name (already set in step 2), a local user, an enable secret, RSA keys, and transport input ssh on the vty lines. That page also covers connecting from a modern client, which needs legacy-algorithm options on older IOS.

Do both from the console and keep that session open until a fresh SSH login is proven, then save again — remote management is exactly the thing you don't want half-configured.

Full Sequence (Reference)¶

This can't be pasted as one block — the reload reboots the switch, and the reset commands each stop for a confirmation prompt. Run the reset lines one at a time, then paste the configuration block after the switch is back up.

1. Factory reset — enter line by line, confirming each prompt:

enable
erase startup-config
delete vlan.dat
reload

2. After the reboot — answer no to "Would you like to enter the initial configuration dialog?", then paste:

enable
conf t
hostname SW01
no ip domain-lookup

vlan 10
 name Office
vlan 20
 name Guest
vlan 999
 name UNUSED

interface range Gi0/1 - 47
 shutdown
 switchport access vlan 999

interface Gi0/48
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999
 no shutdown

! Edit these two ranges to cover only the ports actually in use today
interface range Gi0/1 - 8
 switchport mode access
 switchport access vlan 10
 no shutdown

interface range Gi0/41 - 44
 switchport mode access
 switchport access vlan 20
 no shutdown

end
copy running-config startup-config

Once this baseline is in place, layer on the Security Hardening checklist before putting the switch into production.