Skip to content

Device Setup Fundamentals

How to get onto a Cisco switch for the very first time and reach the point where you can start configuring it — the prerequisite for the Step-by-Step Switch Configuration walkthrough, which picks up right after this.

Physical / Console Access

A brand-new or factory-reset switch has no IP address reachable over the network, so the console port is the only way in:

On your laptop's terminal (macOS):

ls /dev/*usb*          # Check for TTY port
screen [pasted tty] 9600   # Connect (9600 baud for most Cisco switches)

On a Linux laptop the adapter shows up as /dev/ttyUSB0 — use ls /dev/ttyUSB* instead.

A blank switch boots into the initial configuration dialog — answer no to Would you like to enter the initial configuration dialog? [yes/no]:, then press RETURN to get the normal Switch> prompt and configure manually.

See Cisco IOS CLI Reference for the full connection command.

Out-of-Band vs In-Band Management

  • Out-of-band (OOB): the console port, or a dedicated management port/VLAN not used for regular traffic. Always reachable even if the data plane is misconfigured — this is why console access matters for password recovery too.
  • In-band: managing the switch over the same network it's switching (e.g. SSH to its management VLAN IP). Convenient day-to-day, but useless if that VLAN itself is broken.

Default State of a New Switch

Out of the box (or after erase startup-config + delete vlan.dat + reload — see Erasing / Factory Reset):

  • No hostname, no passwords set
  • All ports in VLAN 1, in DTP mode dynamic auto — they behave as access ports until a neighbor set to trunk or dynamic desirable negotiates a trunk, which is why access/trunk mode is set explicitly during configuration
  • No IP address configured anywhere — the switch is unreachable over the network until one is set
  • Spanning Tree running with default priorities (see Spanning Tree Protocol)

Assigning a Management IP

For a purely Layer 2 switch (no ip routing), management IP goes on an SVI — typically a dedicated management VLAN, not VLAN 1. From the console session, enter privileged EXEC then global configuration mode first:

enable
conf t

vlan 99
 name Management

interface Vlan99
 ip address 10.0.99.10 255.255.255.0
 no shutdown

ip default-gateway 10.0.99.1

ip default-gateway (not ip route) is what a Layer 2-only switch uses to reach networks outside its own VLANs for management traffic — it only applies when ip routing is disabled. If the switch is also doing inter-VLAN routing (see VLANs & Inter-VLAN Routing), a normal default route via ip route 0.0.0.0 0.0.0.0 <next-hop> is used instead.

The Vlan99 SVI won't come up on its own — Cisco's autostate feature keeps an SVI down until the VLAN exists and at least one connected Layer 2 port carrying that VLAN is up and STP-forwarding. On a factory-default switch every port is still in VLAN 1, so first put the port facing the management network into VLAN 99 (or add VLAN 99 to the allowed list on the trunk uplink):

interface Gi0/48
 switchport mode access
 switchport access vlan 99

Once that port is cabled and up, Vlan99 will show up/up.

Enabling Remote Access

Once the management IP is reachable, lock down how it's reachable — see SSH Management Only for the full config. Don't leave Telnet enabled even temporarily.

Login Banner — Mind the Delimiter

banner motd takes the first character after the command as the delimiter that marks where the message ends. Type the message bare and IOS eats its first letter:

banner motd SW03 Welcomes You

S becomes the delimiter, the banner starts at W03, and it stays unterminated until the next S appears — so the switch greets you with W03 Welcomes You. Nothing errors.

Always wrap the text in a delimiter that doesn't occur in the message:

banner motd #SW03 Welcomes You#

Check what actually got stored, not what you typed:

show running-config | begin banner

The same rule applies to banner login and banner exec. ^C is the conventional delimiter in Cisco documentation, but any unused character works — # is easier to type and to paste.

Verifying Access

On the switch (privileged EXEC):

! Confirm the management SVI is up/up with the right IP
show ip interface brief

! Confirm the gateway is reachable
ping 10.0.99.1

From a workstation on the management VLAN: ssh admin@10.0.99.10 to confirm remote access actually works before walking away from the console cable.