Switch Configuration Essentials

Most switch outages are configuration mistakes, not dead hardware. This is the baseline Nettech uses before any Catalyst access or distribution switch goes into production. Follow it in order; skip steps only when you have a documented exception.

1. Start from a known-clean state

Never assume factory defaults. A switch that sat in a closet may still hold someone else's enable secret, RADIUS config, or stale trunks.

1. Console in at 9600 8N1 (most Catalyst). Newer 9300-class units are the same unless your BOM specifies otherwise.
2. From enable mode: write erase then reload. Confirm the wipe when prompted.
3. Do not save a half-built config mid-wipe. After reload you want the setup dialog or a blank running-config.
4. Set the clock early: clock set or NTP (below). Logs without time are nearly useless in an incident.

Rule: If you did not wipe it, you do not trust it.

2. Identity, management path, and access control

Build a management path before you build data-plane complexity.

• Hostname that matches your DCIM/labels: hostname ACCESS-IDF3-SW1
• Domain / DNS if you use FQDN in AAA or certs
• Dedicated management VLAN — never manage off a user VLAN long-term
• SVI + default gateway only on the management VLAN; shut unused SVIs
• SSH only: generate RSA keys, transport input ssh on vty, disable telnet
• AAA or strong local accounts — no shared cisco/cisco; use enable secret (not enable password)
• VTY ACL locking SSH to jump hosts / management subnets
• NTP to two internal sources; syslog to a collector before you call it done
• SNMP: v3 preferred; if v2c is required, long community + ACL, never "public"

3. VLAN and trunk hygiene

• Create only VLANs you need; name every VLAN.
• Access ports: switchport mode access, fixed VLAN, spanning-tree portfast where appropriate, bpduguard enable on edge ports.
• Disable DTP on access ports: switchport nonegotiate (or force access so ports cannot self-trunk).
• Trunks: explicit allowed VLAN list — never leave "all" on production uplinks.
• Native VLAN: not VLAN 1; match both ends; prune native from user traffic where design allows.
• Shut unused ports or park them in a black-hole VLAN with no SVI.

4. Stacking (StackWise) without split-brain

1. Cable stack rings redundantly — a single stack cable is a future outage.
2. Set priorities so the intended master wins (switch 1 priority 15, etc.) before you rely on the stack.
3. Confirm one logical switch: show switch — all members Ready, expected master active.
4. After changes, show switch stack-ring speed / stack bandwidth as applicable to the platform.
5. Per-member configs matter for password recovery and replacements — document stack member numbers on the faceplate.

5. Uplinks, EtherChannel, and spanning tree

• Know your root bridge; do not let a closet switch win the election by accident.
• Port-channels: same config on bundled members; confirm show etherchannel summary is clean (P state).
• Match speed/duplex/MTU; avoid mixed copper/optics surprises in one channel.
• On L3 distribution, confirm routing adjacency only after L2 is stable.

6. Config save and backup discipline

1. copy running-config startup-config (or write memory) before you leave the console.
2. Export off-box the same day: TFTP/SCP/USB — a nightly job is better than a hero moment.
3. Store configs with hostname + date; treat them as sensitive (credentials, SNMP, keys).

7. Verification before you walk away (20 minutes)

• show vlan brief — expected VLANs only
• show interfaces status — uplinks up, no err-disabled surprises
• show cdp neighbors / show lldp neighbors — correct upstream
• show spanning-tree root — correct root and port roles
• show ip interface brief — management SVI up
• SSH from a jump host using the production path (not only console)
• If redundant: fail a link once and confirm recovery

Need this done at scale? Nettech stages and labels Catalyst switches before ship — rack, connect uplinks, and go. Request staging & config help · Shop switches