How to Configure a Cisco Switch: Initial Setup, Management IP, VLANs, Trunks, and SSH

Configuring a Cisco switch for first-time deployment usually includes console access, basic security, setting a management IP, VLAN preparation, trunk uplinks, and enabling SSH for remote access. On modern Cisco Catalyst switches, the best approach is to follow a clear, sequential setup workflow, moving deeper topics such as VLAN design or advanced SSH hardening into dedicated configuration guides.

Executive Summary

A Cisco switch should not be configured as a random collection of isolated commands. In real enterprise deployments, the initial setup process is highly sequential: it starts with physical console access and basic security, then moves to management reachability, logical VLAN structure, uplink connectivity, and secure remote access.

This guide explains the correct setup order for modern Cisco Catalyst switches and demonstrates where each component fits into the larger deployment workflow. It is designed as a practical initial configuration guide. For advanced deep dives, you will find links to our dedicated companion articles on VLAN segmentation and SSH hardening throughout this workflow.

What Do You Need Before Configuring a Cisco Switch?

Before you plug in your new Catalyst switch, you need to prepare your environment. This guide focuses on modern Cisco IOS-XE environments. You will need:

• A physical console cable (RJ-45 to USB or Serial) and a terminal application (like PuTTY or SecureCRT).
• An IP Plan: A dedicated IP address, subnet mask, and default gateway for the switch’s management interface.
• A VLAN Plan: Knowing which VLAN ID will be used for management traffic.

This is a practical “initial setup workflow” for production, not an isolated lab experiment. Having your IP and VLAN plans ready prevents lockouts during deployment.

How to Access a Cisco Switch for the First Time

Out of the box, a Cisco switch has no IP address and no SSH access. You must use a console cable to connect directly to the device. When you open your terminal application (usually 9600 baud rate, 8 data bits, no parity, 1 stop bit), you will see the default unconfigured state.

You must navigate through Cisco’s Command Line Interface (CLI) modes:

1. User EXEC Mode (Switch>): Very limited view-only mode.
2. Privileged EXEC Mode (Switch#): Allows you to view all configurations and save changes. Reached by typing enable.
3. Global Configuration Mode (Switch(config)#): Where actual changes are made. Reached by typing configure terminal.

Bash

Switch> enable
Switch# configure terminal
Switch(config)# 

How to Configure Hostname, Passwords, and Basic Security

The first configuration step is giving the switch an identity and securing the core access points. Do not connect a switch to your network without completing this baseline security.

Bash

# Set the device name
Switch(config)# hostname Core-SW-01

# Secure Privileged EXEC mode
Core-SW-01(config)# enable secret StrongPassword123!

# Create a local administrative user
Core-SW-01(config)# username admin privilege 15 secret AdminPass456!

# Encrypt all plaintext passwords in the configuration file
Core-SW-01(config)# service password-encryption

Setting the hostname first makes the CLI prompt clear, reducing the risk of accidentally configuring the wrong device when multiple terminal windows are open.

How to Configure a Management IP Address on a Cisco Switch

For a Layer 2 access switch, management reachability is established by configuring a Switch Virtual Interface (SVI). This interface acts as the logical IP address for the switch itself, allowing you to ping it and connect remotely.

Bash

# Create and enter the Management VLAN interface (e.g., VLAN 99)
Core-SW-01(config)# interface vlan 99
Core-SW-01(config-if)# ip address 10.0.99.10 255.255.255.0
Core-SW-01(config-if)# no shutdown
Core-SW-01(config-if)# exit

# Set the default gateway so the switch can reply to other subnets
Core-SW-01(config)# ip default-gateway 10.0.99.1

Crucial SVI Dependency: An SVI (interface vlan 99) will remain in a “down/down” state until VLAN 99 exists in the VLAN database and at least one active physical port is forwarding traffic on that VLAN.

Management IP Verification Checklist:

Command	What to Verify
show ip interface brief	Ensure Vlan99 shows Status: up and Protocol: up.
ping 10.0.99.1	Verify the switch can reach its default gateway.

How to Save and Verify the Initial Switch Configuration

If you reboot the switch right now, all your work will be lost. Cisco switches run your current changes in RAM (the running-config). You must save them to NVRAM (the startup-config).

Bash

# Exit to Privileged EXEC mode
Core-SW-01(config)# end

# Save the configuration
Core-SW-01# write memory

(Note: copy running-config startup-config performs the exact same function). Always run show running-config to review your work before finalizing the deployment. Forgetting to save is the number one mistake made during initial deployments.

How VLANs Fit into Basic Cisco Switch Configuration

In enterprise networks, you never leave all ports on the default VLAN 1 due to broadcast and security risks. During initial setup, you simply create the necessary logical segments.

Bash

Core-SW-01(config)# vlan 10
Core-SW-01(config-vlan)# name DATA

In this setup phase, you define the database. For a comprehensive deep dive into assigning ports, avoiding vlan.dat persistence traps, and troubleshooting, read our full guide on How to Configure VLAN on a Cisco Switch.

How Access Ports and Trunk Ports Fit into Cisco Switch Setup

After defining VLANs, physical ports must be assigned a role:

• Access Ports: Connect to end-user devices (PCs, printers) and carry only one VLAN.
• Trunk Ports: Connect to other switches, routers, or firewalls, carrying multiple VLANs across a single uplink.

Minimal trunk setup for an uplink:

Bash

Core-SW-01(config)# interface GigabitEthernet1/0/48
Core-SW-01(config-if)# switchport mode trunk

For advanced trunking, native VLAN configurations, and avoiding the dangerous “allowed VLAN overwrite” mistake, see our dedicated Cisco Access vs. Trunk Port Guide.

How to Enable SSH for Secure Remote Management

Telnet is unencrypted and highly insecure. Enabling SSH is the final step of the initial setup, allowing you to unplug the console cable and manage the switch from your desk via the IP address configured earlier.

Bash

# Define a domain name (required for generating crypto keys)
Core-SW-01(config)# ip domain-name company.local

# Generate RSA encryption keys
Core-SW-01(config)# crypto key generate rsa modulus 2048

# Enforce local login and SSH only on virtual terminal lines
Core-SW-01(config)# line vty 0 4
Core-SW-01(config-line)# login local
Core-SW-01(config-line)# transport input ssh

Once this is applied, your initial deployment is complete. For advanced SSH tuning, timeouts, and access control lists (ACLs), visit our complete guide on How to Enable SSH on a Cisco Switch.

Common Cisco Switch Setup Mistakes

Avoid these high-frequency deployment errors:

• Forgetting to save the config: The switch reboots and returns to factory default because write memory was omitted.
• SVI configured but VLAN inactive: You assigned an IP to interface vlan 10, but never actually created vlan 10 in global config, leaving the interface perpetually down.
• Trunk configured but VLAN not allowed: Forgetting to allow the management VLAN across the uplink trunk, completely isolating the switch.
• SSH configured before management IP works: Generating crypto keys before ensuring the switch is actually reachable over the network.
• Leaving everything on VLAN 1: Using the default VLAN for management and data traffic, violating basic security hygiene.

Recommended Initial Configuration Workflow for Cisco Catalyst Switches

To avoid locking yourself out, always configure a new Cisco switch in this exact sequence:

1. Access by console: Establish physical serial connectivity.
2. Set hostname and credentials: Define the device name and secure the enable password.
3. Configure management IP: Create the SVI and default gateway.
4. Create basic VLAN structure: Add your management and data VLANs to the database.
5. Assign access/trunk interfaces: Map the physical uplink ports so the management IP becomes reachable.
6. Enable SSH: Generate keys and secure the VTY lines.
7. Save and verify: Run write memory and test SSH access before disconnecting the console cable.

Frequently Asked Questions About Cisco Switch Configuration