Cisco | Cisco 2960 Switch Configuration (PID: WS-C2960-24TC-L)

Cisco 2960 Switch Configuration (PID: WS-C2960-24TC-L):

Changing Switch Hostname:

Switch(config)#hostname DST-SW

Configuring Passwords:

DST-SW(config)#enable secret sysadmin

DST-SW(config)#enable secret sysadmin

Securing Console Port:

DST-SW(config)#line con 0 

DST-SW(config-line)#password sysadmin

DST-SW(config-line)#login 

Securing Terminal Lines:

DST-SW(config)#line vty 0 4 

DST-SW(config-line)#password sysadmin

DST-SW(config-line)#login

Encrypting Passwords:

DST-SW(config)#service password-encryption

Configuring Banners:

DST-SW(config)#banner motd 

$ -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- UNAUTHORIZED ACCESS IS PROHIBITED -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- $

Giving the Switch an IP Address:

DST-SW(config)#interface vlan 1 

DST-SW(config-if)#ip address 192.168.101.2 255.255.255.0 

DST-SW(config-if)#shutdown 

Setting the Default Gateway:

DST-SW(config)#ip default-gateway 192.168.101.1

Saving Configuration:

DST-SW#copy running-config startup-config

Destination filename [startup-config]? 

Building configuration… [OK]

Or

DST-SW#wr 

Building configuration… [OK] 

Working Environment (name lookup, history, exec-timeout and logging behavior):

DST-SW(config)#no ip domain-lookup 

DST-SW(config)#line vty 0 4 

DST-SW(config-line)#history size 15 

DST-SW(config-line)# exec-timeout 10 30 

DST-SW(config-line)#logging synchronous

 

Configuring Switch to use SSH:

• Configure DNS domain name: 

DST-SW(config)#ip domain-name example.com 

• Configure a username and password: 

DST-SW(config)#username admin secrat cisco 

• Generate encryption keys: 

DST-SW(config)#crypto key generate rsa How many bits in the modulus [512]: 1024 

• Define SSH version to use: 

DST-SW(config)#ip ssh version 2 

• Enable vty lines to use SSH: 

DST-SW(config)#line vty 0 4 

DST-SW(config-line)#login local 

DST-SW(config-line)#transport input telnet ssh 

Description, Speed, and Duplex:

DST-SW(config)#interface fastEthernet 0/1 

DST-SW(config-if)#description ***To-Core RTR***

DST-SW(config-if)#speed 100 (options: 10, 100, auto) 

DST-SW(config)#interface range fastEthernet 0/5 – 10 

DST-SW(config-if-range)#duplex full (options: half, full, auto)

Verify Basic Configuration:

• Shows information about the switch and its interfaces, RAM, NVRAM, flash, IOS, etc.

DST-SW#show version 

• Shows the current configuration file stored in DRAM. 

DST-SW#show running-config 

• Shows the configuration file stored in NVRAM which is used at first boot process. 

DST-SW#show startup-config 

• Lists the commands currently held in the history buffer. 

DST-SW#show history 

• Shows an overview of all interfaces, their physical status, protocol status and ip address if assigned. 

DST-SW#show ip interface brief 

• Shows detailed information about the specified interface, its status, protocol, duplex, speed, encapsulation, last 5 min traffic. 

DST-SW#show interface vlan 1 

• Shows the description of all interfaces 

DST-SW#show interfaces description 

• Shows the status of all interfaces like connected or not, speed, duplex, trunk or access vlan. 

DST-SW#show interfaces status 

• Shows the public encryption key used for SSH. 

DST-SW#show crypto key mypubkey rsa 

• Shows information about the leased IP address (when an interface is configured to get IP address via a dhcp server)

DST-SW#show dhcp lease 

 

Configuring Port Security:

• Make the switch interface an access port

DST-SW(config-if)#switchport mode access 

• Enable port security on the interface: 

DST-SW(config-if)#switchport port-security 

• Specify the maximum number of allowed MAC addresses: 

DST-SW(config-if)#switchport port-security maximum 1 

• Define the action to take when violation occurs: 

DST-SW(config-if)#switchport port-security violation shutdown (options: shutdown, protect, restrict) 

• Specify the allowed MAC addresses: 

DST-SW(config-if)#switchport port-security mac-address 68b5.9965.1195 (options: H.H.H, sticky)

Verify and Troubleshoot Port Security: 

• Shows the entries of the mac address table 

DST-SW#show mac-address-table 

• An overview of port security of all interfaces 

DST-SW#show port-security 

• Shows detailed information about port security on the specified interface 

DST-SW#show port-security interface fa0/5 

Configuring VLANs: 

• Create a new VLAN and give it a name: 

DST-SW(config)#vlan 10 

DST-SW(config-vlan)#name ***To-IT-Users***

 • Assign an access interface to access a specific VLAN: 

DST-SW(config)#interface fastEthernet 0/5 

DST-SW(config-if)#switchport mode access 

DST-SW(config-if)#switchport access vlan 10 

Configuring an auxiliary VLAN for cisco IP phones: 

DST-SW(config)#interface fastEthernet 0/5 

DST-SW(config-if)#switchport access vlan 10 

DST-SW(config-if)#switchport voice vlan 12 

Configuring Trunks:

DST-SW(config)#interface fastEthernet 0/1 

DST-SW(config-if)#switchport mode trunk (options: access, trunk, dynamic auto, dynamic desirable) DST-SW(config-if)#switchport trunk allowed

Securing VLANS and Trunking:

• Administratively disable unused interfaces: 

DST-SW(config-if)#shutdown 

• Prevent trunking by disabling auto negotiation on the interface: 

DST-SW(config-if)#nonegotiate (or hardcode the port as an access port) 

DST-SW(config-if)#switchport mode access 

• Assign the port to an unused VLAN: 

DST-SW(config-if)#switchport access vlan 222 

STP optimization:

• Hard coding the root bridge (changing bridge priority): 

DST-SW(config)#spanning-tree vlan 1 root primary 

DST-SW(config)#spanning-tree vlan 1 root secondary 

DST-SW(config)#spanning-tree [vlan 1] priority 8192 

• Changing the STP mode: 

DST-SW(config)#spanning-tree mode rapid-pvst (options: mst, pvst, rapid-pvst) 

• Enabling portfast and BPDU guard on an interface: 

DST-SW(config-if)#spanning-tree portfast 

DST-SW(config-if)#spanning-tree bpduguard enable 

• Changing port cost: 

DST-SW(config-if)#spanning-tree [vlan 1] cost 25 

• Bundling interfaces into an etherchannel: 

DST-SW(config-if)#channel-group 1 mode on (options: auto, desirable, on)

STP Verification and Troubleshooting:

• Shows detailed info about STP state 

DST-SW#show spanning-tree 

• Shows STP info only on a specific port 

DST-SW#show spanning-tree interface fa0/2 

• Shows STP info only for a specific VLAN 

DST-SW#show spanning-tree vlan 1 

• Shows info about the root switch 

DST-SW#show spanning-tree [vlan1] root 

• Shows info about the local switch 

DST-SW#show spanning-tree [vlan1] bridge 

• Show the state of the etherchannels 

DST-SW#show etherchannel 1 

• Provides informational messages about the changes in the STP topology 

DST-SW#debug spanning-tree events 

Enabling or disabling CDP: 

• Enabling CDP globally on a switch: 

DST-SW(config)#cdp run 

• Disabling CDP on a given interface: 

DST-SW(config-if)#no cdp enable  

Using CDP for Network Verification and Troubleshooting:

• Shows global information about CDP itself 

DST-SWSW1#show cdp 

• Shows information about CDP on a specific interface 

DST-SW#show cdp interface fa0/2 

• Shows information about the directly connected cisco devices including interfaces names capabilities 

DST-SW#show cdp neighbors 

• Shows detailed information about the neighboring cisco devices including device address and version of IOS they run 

DST-SW#show cdp neighbors detail 

• Same as show cdp neighbor detail 

DST-SW#show cdp entry * 

• Shows detailed information about the specified entry only 

DST-SW#show cdp entry DST-SW2