Configure a Cisco IOS XE Layer 2 Switch

This guide configures a Cisco Catalyst switch running IOS or IOS XE as a Layer 2 access switch. It adds secure management access, a dedicated management VLAN, data VLANs, access ports, a static trunk, spanning-tree edge protection, and an unused-port policy.

Official references:

Interface names, supported commands, VTY ranges, and file locations vary by switch model and software release. Review the platform documentation and keep console access until remote management has been tested.

Example Design

The example uses these VLANs and ports on a 24-port access switch:

VLAN	Name	Purpose
10	`USERS`	User access ports `Gi1/0/1-16`
20	`SERVERS`	Server access ports `Gi1/0/17-20`
99	`MANAGEMENT`	Switch management SVI
999	`UNUSED`	Administratively disabled ports

The switch management address is 192.168.99.2/24, and its Layer 2 management default gateway is 192.168.99.1. Port Gi1/0/24 is a static trunk carrying VLANs 10, 20, and 99 to the upstream switch or router.

Replace the interface ranges, addresses, VLAN IDs, and uplink with values from the approved network design.

Inspect the Existing Switch

Record the model, software, stack members, interfaces, VLANs, trunks, spanning-tree state, and current management configuration:

show version
show inventory
show switch
show interfaces status
show ip interface brief
show vlan brief
show interfaces trunk
show spanning-tree summary
show running-config | section line
show running-config | include ^hostname|^username|^enable secret|^ip domain|^ip default-gateway|^ip routing

The show switch command applies to supported stackable models and can be unavailable on a standalone switch. On a production switch, save an external backup and confirm console or out-of-band access before changing management, VLAN, trunk, or authentication settings.

Understand Running and Startup Configuration

Most IOS XE commands change the running configuration immediately. The startup configuration is the saved copy loaded after a reboot.

Display both files:

show running-config
show startup-config

Save the running configuration:

copy system:running-config nvram:startup-config

This common alias normally performs the same operation:

copy running-config startup-config

The valid name is running-config, with a hyphen. running_config is not valid IOS or IOS XE syntax.

Configure the Switch Identity

Enter privileged EXEC and global configuration modes:

enable
configure terminal

Set the hostname and internal domain name. Common IOS and IOS XE platforms require both before generating an SSH host key:

hostname SW1
ip domain name example.net
banner motd ^CUnauthorized access to this device is prohibited.^C

Replace example.net with the assigned internal domain. The ^C characters delimit the banner and are not displayed to users.

Configure Local Credentials

Replace both example values with different, randomly generated secrets before entering the commands:

security passwords min-length 12
username netadmin privilege 15 secret REPLACE_WITH_A_UNIQUE_ADMIN_SECRET
enable secret REPLACE_WITH_A_DIFFERENT_ENABLE_SECRET
login block-for 180 attempts 3 within 60
login delay 2

The secret form stores a one-way verifier supported by the platform. Avoid shared line passwords and the older clear-text password form for administrator access.

The optional command below obscures remaining clear-text line or protocol passwords in the configuration:

service password-encryption

This commonly creates reversible type 7 values. It prevents casual viewing but does not provide strong password storage or encrypt traffic. Use secret credentials and SSH.

Configure Console and SSH Access

Use the local account for console access and close an idle console session after ten minutes:

line console 0
login local
exec-timeout 10 0
logging synchronous
exit

Enable SSHv2 and generate an RSA host key. The example uses 4096 bits; use the largest size supported by the platform and security policy, with at least 2048 bits when supported:

ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
crypto key generate rsa general-keys modulus 4096

Configure every VTY line to use the local account and accept SSH only:

line vty 0 15
login local
transport input ssh
exec-timeout 10 0
exit

Some switches provide only VTY lines 0 4. Check the device and configure every available line:

show running-config | section line vty

If the switch web interface is not part of the management design, disable both HTTP services:

no ip http server
no ip http secure-server

Do not close the console session until SSH has been tested through the management network.

Create the VLANs

Create the user, server, management, and unused-port VLANs:

vlan 10
name USERS
exit
vlan 20
name SERVERS
exit
vlan 99
name MANAGEMENT
exit
vlan 999
name UNUSED
exit

Verify the VLAN database:

end
show vlan brief

A dedicated management VLAN makes addressing and policy easier to operate, but it is not a security boundary by itself. Restrict it at the upstream router, firewall, management VRF, or control plane according to the network design.

Configure the Management SVI

Create a switch virtual interface for VLAN 99 and assign its management address:

configure terminal
interface Vlan99
description Management SVI
ip address 192.168.99.2 255.255.255.0
no shutdown
exit

For a Layer 2 switch with IP routing disabled, configure the next-hop router in the same subnet:

ip default-gateway 192.168.99.1

Do not disable IP routing blindly on a multilayer switch already providing routed services. First check the intended role and current setting:

show running-config | include ^ip routing|^ip default-gateway
show ip route

When ip routing is enabled on a Layer 3 switch, use a route instead of ip default-gateway, for example:

ip route 0.0.0.0 0.0.0.0 192.168.99.1

Use only the model that matches the approved Layer 2 or Layer 3 design.

An SVI generally reaches up/up only when its VLAN exists and at least one Layer 2 access or trunk port carrying that VLAN is physically up and forwarding for spanning tree. The management SVI may remain down until the uplink is configured and connected.

Configure User Access Ports

Assign ports Gi1/0/1-16 to VLAN 10. Enable PortFast and BPDU Guard because these ports are intended for individual end devices:

interface range GigabitEthernet1/0/1-16
description User access ports
switchport mode access
switchport access vlan 10
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
exit

PortFast skips the normal spanning-tree forwarding delay. BPDU Guard places the port in an error-disabled state if it receives a bridge protocol data unit. Apply both only to edge ports connected to end devices, never to links between switches, bridges, or other Layer 2 infrastructure.

Configure Server Access Ports

Assign ports Gi1/0/17-20 to VLAN 20:

interface range GigabitEthernet1/0/17-20
description Server access ports
switchport mode access
switchport access vlan 20
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
exit

Do not use PortFast when a server runs a bridge, hypervisor virtual switch, or appliance that can forward Layer 2 frames unless the design has evaluated the loop risk.

Disable Unused Ports

Move unused ports to an isolated VLAN and shut them down. This example uses ports Gi1/0/21-23:

interface range GigabitEthernet1/0/21-23
description UNUSED - administratively disabled
switchport mode access
switchport access vlan 999
shutdown
exit

The unused VLAN should not have an SVI or be allowed on trunks unless the design has a specific reason.

Configure the Uplink Trunk

Configure Gi1/0/24 as a static trunk and limit it to the VLANs required by this switch:

interface GigabitEthernet1/0/24
description Uplink to distribution switch
switchport mode trunk
switchport trunk allowed vlan 10,20,99
switchport nonegotiate
no shutdown
exit
end

switchport nonegotiate stops Dynamic Trunking Protocol frames. Use it when the neighboring interface is also configured statically. Some platforms or interface types do not support this command.

Do not enable PortFast or edge BPDU Guard on this switch-to-switch uplink. Configure the same allowed VLANs and a compatible native VLAN on both ends. A mismatch can interrupt connectivity or create untagged-VLAN problems.

Verify the trunk and the per-interface switchport state:

show interfaces trunk
show interfaces GigabitEthernet1/0/24 switchport

Verify the Switch

Check the VLAN membership, ports, trunk, SVI, spanning tree, and MAC-address learning:

show vlan brief
show interfaces status
show interfaces trunk
show ip interface brief
show spanning-tree summary
show spanning-tree vlan 10,20,99
show mac address-table dynamic

The expected state is:

User ports belong to VLAN 10.
Server ports belong to VLAN 20.
Unused ports belong to VLAN 999 and are disabled.
The uplink trunks VLANs 10, 20, and 99.
Vlan99 is up/up after an active forwarding port carries VLAN 99.

Test the management gateway:

ping 192.168.99.1 source 192.168.99.2

From an authorized management workstation, test SSH in a second session:

ssh netadmin@192.168.99.2

Verify the SSH server and active users on the switch:

show ip ssh
show ssh
show users

Inspect Individual Ports

Display one interface’s physical state, errors, VLAN mode, and learned MAC addresses:

show interfaces GigabitEthernet1/0/1
show interfaces GigabitEthernet1/0/1 counters errors
show interfaces GigabitEthernet1/0/1 switchport
show mac address-table interface GigabitEthernet1/0/1

Check discovery information when CDP or LLDP is enabled by policy:

show cdp neighbors detail
show lldp neighbors detail

Save and Back Up the Configuration

Review the management, VLAN, interface, and line configuration before saving:

show running-config | section interface Vlan99
show running-config | section interface GigabitEthernet1/0/24
show running-config | section line console
show running-config | section line vty
show vlan brief
show interfaces trunk

Save the running configuration:

copy system:running-config nvram:startup-config

Press Enter to accept the default destination filename when prompted, then verify the startup configuration:

show startup-config

When SCP is configured and permitted, create an external backup:

copy system:running-config scp:

Protect configuration backups because they can contain usernames, password verifiers, addresses, keys, VLANs, and topology details.

Troubleshooting

The Management SVI Is Down

Check that VLAN 99 exists, the SVI is enabled, and at least one active access or trunk port carries the VLAN in spanning-tree forwarding state:

show vlan id 99
show ip interface brief | include Vlan99
show interfaces trunk
show spanning-tree vlan 99
show interfaces status

An administratively down SVI needs no shutdown. A line-protocol-down SVI usually has no active forwarding member port in that VLAN.

The Switch Cannot Reach Another Subnet

For a Layer 2 switch, verify the management address, mask, and default gateway:

show running-config | section interface Vlan99
show running-config | include ^ip default-gateway|^ip routing
show arp
ping 192.168.99.1 source 192.168.99.2

If ip routing is enabled, inspect the routing table and configure the appropriate static or dynamic route instead of relying on ip default-gateway:

show ip route

A VLAN Does Not Cross the Uplink

Compare both ends of the trunk:

show interfaces trunk
show interfaces GigabitEthernet1/0/24 switchport
show vlan brief
show spanning-tree vlan 10

Confirm that the VLAN exists, is allowed on both ends, is not suspended, and uses a matching native VLAN. Also verify that spanning tree is forwarding on the expected path.

An Access Port Is Error-Disabled

Check the reason and logs before re-enabling the port:

show interfaces status err-disabled
show errdisable recovery
show logging | include ERR_DISABLE|BPDUGUARD

If BPDU Guard disabled the port, remove the connected bridge or correct the port role first. Then recover it manually:

configure terminal
interface GigabitEthernet1/0/1
shutdown
no shutdown
end

Do not disable BPDU Guard simply to hide an unexpected BPDU on an end-device port.

SSH Does Not Start

Verify the hostname, domain, local user, RSA key, SSH version, VTY authentication, and management reachability:

show running-config | include ^hostname|^ip domain|^username
show crypto key mypubkey rsa
show ip ssh
show running-config | section line vty
show ip interface brief | include Vlan99

Generate a supported RSA key only after configuring the hostname and domain name. Ensure that every VTY line uses login local and transport input ssh.

Erase the Switch and VLAN Configuration

Factory reset is destructive. It removes management access, interface settings, local users, VLANs, and other saved configuration. Save an external backup and use a console connection before proceeding.

Locate the startup configuration and VLAN database because storage paths vary by platform and stack member:

show file systems
dir nvram:
dir flash: | include vlan.dat
show startup-config

Erase the startup configuration:

erase nvram:startup-config

This common alias is also supported on many Catalyst switches:

erase startup-config

When the platform stores VLAN information separately, delete the identified VLAN database file:

delete flash:vlan.dat

Confirm the deletion prompts and verify that the exact path is correct. Stack members or older modular switches can store the file on a different filesystem.

Reload the switch only when the reset is intentional:

reload

When prompted to save the modified running configuration during this reset procedure, saving would recreate a startup configuration. Read every prompt before responding. After the reload, the switch normally starts with default settings or the initial setup dialog.