How to configure Cisco switches – step by step

1. Connect the Switch to PuTTY

To start configuration, you want to connect the switch console to PuTTY. You can do this by doing the following:

  1. Connect the switch to PuTTY with a 9-pin serial cable.
  2. Now open PuTTY and the PuTTY Configuration window will display. Go to the Connection type settings and check the Serial option (shown below).
  1. Go to the Category list section on the left-hand side and select the Serial option.
  2. When the options controlling local serial lines page displays enter the COM port your device is connected to in the Serial line to connect to box e.g. COM1.
  3. Next, enter the digital transmission speed of your switch model. For 300 and 500 Series Managed Switches, this is 115200.
  4. Go to the Data bits field and enter 8.
  5. Now go to the Stops bits field and enter 1.
  6. Click on the Parity drop-down menu and select the None option.
  7. Go to the Flow Control drop-down menu and select the None option.

Save Your Settings and Start the PuTTY CLI

To save your PuTTY settings for your next session do the following:

  1. Click on the Session option from the Category list on the left-hand side of the page.
  1. Go to the Saved Session field and enter a name for your settings e.g. Comparitech.
  2. Click the Save button to store the settings.
  3. Press the Open button at the bottom of the page to launch the CLI.

The following message will display in the command prompt:


2. Enter Privileged EXEC Mode and Set a Hostname for the Switch

Type in the enable command to enter privileged EXEC mode (you don’t need a password at this stage because you’re under the default configurations which don’t have one!):


Next, enter Global Configuration Mode and enter the following command:

Switch# configure terminal 

You can make the switch easier to locate in the network by assigning a hostname. Enter the following command to assign a hostname:

Switch(config)# hostname access-switch1 

3. Assign a Password to the Switch

Once you’ve assigned a hostname you will want to create a password to control who has access to the privileged EXEC mode (to prevent everyone from being able to log in). To assign an administrator password to enter the following command:

access-switch1(config)# enable secret COMPARI7ECH

Remember to pick a strong password so that it’s harder to figure out.

4. Configure Telnet and Console Access Passwords

The next step is to configure passwords for Telnet and console access. Configuring passwords for these is important because it makes your switch more secure. If someone without authorization gains telnet access then it puts your network at serious risk. You can configure passwords by entering the following lines (See the top paragraph for Telnet and the bottom paragraph for Console access).


access-switch1(config)# line vty 0 15

access-switch1(config-line)# password COMPARI7ECH

access-switch1(config-line)# login

access-switch1(config-line)# exit



access-switch1(config)# line console 0

access-switch1(config-line)# password COMPARI7ECH 

access-switch1(config-line)# login

access-switch1(config-line)# exit


5. Configure IP Addresses With Telnet Access

The next step is to decide which IP addresses will have access to Telnet, and add them with the PuTTY CLI. To select permitted IP’s enter the following command (replace the listed IPs with the IPs of the components you want to grant permission to):

access-switch1(config)# ip access-list standard TELNET-ACCESS

access-switch1(config-std-nacl)# permit

access-switch1(config-std-nacl)# permit

access-switch1(config-std-nacl)# exit

You can also configure access control lists (ACLs) to virtual terminal (VTY) lines. ACLs ensure that only the administrator can connect to the router through Telnet.

access-switch1(config)# line vty 0 15

access-switch1(config-line)# access-class TELNET-ACCESS in

access-switch1(config-line)# exit


6. Configure a Management IP address (or Management Interface)

Next, you need to configure a management IP address. Switches don’t come with an IP address by default, meaning that you can’t connect to it with Telnet or SSH. To solve this problem you can select a virtual LAN(VLAN) on the switch and create a virtual interface with an IP address. You can do this by entering the following command:

access-switch1(config)# interface vlan 1

access-switch1(config-if)# ip address

access-switch1(config-if)# exit


The new IP management address is located in VLAN1, which other computers will now use to connect.

7. Assign a Default Gateway to the Switch

At this stage, you want to assign a default gateway to the switch. The default gateway is essentially the address of the router that the switch will be communicating with. If you don’t configure a default gateway then VLAN1 will be unable to send traffic to another network. To assign the default gateway enter the command below (change the IP address to that of your router).

access-switch1(config)# ip default-gateway

8. Disable Unused Open Ports

As a best practice, it is a good idea to disable any unused open ports on the switch. Cybercriminals often use unsecured ports as a way to breach a network. Closing these ports down reduces the number of entry points into your network and makes your switch more secure. Enter the range of ports you want to close by entering the following command (you would change 0/25-48 to the ports that you want to close):

access-switch1(config)# interface range fe 0/25-48

access-switch1(config-if-range)# shutdown

access-switch1(config-if-range)# exit


9. Save Your Configuration Settings

Once you’ve finished configuring the router it’s time to save your configuration. Saving the configuration will make sure that your settings are the same when you open up your next session. To save enter the following command:

access-switch1(config)# exit
access-switch1# wr

Always remember to save any changes to your settings before closing the CLI.

10. Configure NetFlow to Manage Your Cisco Switch (Optional)

It is also a good idea to use a network traffic analyzer to monitor network traffic. As a Cisco device, your switch will have the communication protocol NetFlow. However, it must be configured first. You can configure NetFlow by completing the four steps below. Before we begin, enter Global Configuration Mode by executing the following command:

Switch# configure terminal 

Create a flow record

  1. The first step is to create a flow record (you can change the name). You can do this by entering the following command:#flow record Comparitechrecord
  2. After you entered the previous command you need to set the IPv4 source address, IPv4 destination address, iPv4 protocol, transport source-port, transport destination-port, IPv4 dos, interface input, and interface output. You can do this by entering the following command:Switch# match ipv4 source address  Switch# match ipv4 destination address  Switch# match ipv4 protocol  Switch# match transport source-port  Switch# match transport destination-port  Switch# match ipv4 tos  Switch# match interface input  Switch# collect interface output 
  3. To finish configuring the flow record and define the type of data you’re going to collect, enter the following commands:Switch# collect interface output  Switch# collect counter bytes  Switch# collect counter packets  Switch# collect timestamp sys-uptime first  Switch# collect timestamp sys-uptime last 

Create the Flow Exporter

  1. You must now create the flow exporter to store the information that you want to export to an external network analyzer. The first step is to name the flow exporter:Switch# flow exporter Comparitechexport
  2. Enter the IP address of the server your network analyzer is on (Change the IP address):Switch# destination
  3. Configure the interface that you want to export packets with:Switch# destination source gigabitEthernet 0/1 
  4. Configure the port that the software agent will use to listen for network packets:Switch# transport UDP 2055 
  5. Set the type of protocol data that you’re going to export by entering this command:Switch# export-protocol netflow-v9 
  6. To make sure there are no gaps in when flow data is sent enter the following command:Switch# template data timeout 60 

Create a Flow Monitor

  1. Once you’ve configured the flow exporter it is time to create the flow monitor. Create the flow monitor with the following command:<Switch# flow monitor Comparitechmonitor
  2. Associate the flow monitor with the flow record and exporter we configured earlier:Switch# record Comparitechrecord Switch# exporter Comparitechexport
  3. To make sure that flow information is collected and normalized without a delay, enter the following command:Switch# cache timeout active 60 Switch# cache timeout inactive 15 
  4. Enter the exit command:Switch# exit 
  5. You need to input the interfaces that will collect the NetFlow data. If this is an ethernet interface you would enter the following:Switch# interface gigabitEthernet 0/1
  6. Use the following command to configure NetFlow on multiple interfaces (the input command will still collect data in both directions):Switch# ip flow monitor Comparitechmonitor input 
  7. If you want to collect NetFlow data on only one interface then you must use the input and output command. So you would enter the following:Switch# ip flow monitor Comparitechmonitor input Switch# ip flow monitor Comparitechmonitor output 
  8. Exit configuration mode by entering the following command:Switch# exit 
  9. Save your settings to finish.

How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?

Leave a Reply