Your first switch configuration, step by step, in your browser

The first time you sit in front of a Cisco command line it can feel like a blank wall. Which mode am I in? Why did that command fail? The fastest way past that feeling is to configure one small switch from start to finish. You can do it right now in our free Cisco command practice, which runs in your browser. Open it in another tab and follow along.

1. Get into the right mode

Cisco devices have levels, a bit like rooms you walk through. You start in user EXEC mode (the prompt ends in >), where you can only look around. Type enable to reach privileged EXEC (#), then configure terminal, or just conf t, to reach global configuration. Short forms work as long as they are not ambiguous, and ? always lists what you can type next.

2. Give the switch a name

hostname SW-LAB changes the prompt straight away. It sounds cosmetic, but on a real network a clear hostname stops you typing commands into the wrong device.

3. Create the VLANs

vlan 10
 name STAFF
vlan 20
 name GUEST

Each VLAN is a separate broadcast domain: devices in STAFF cannot talk directly to devices in GUEST. Check with do show vlan brief (the do lets you run show commands from configuration mode).

4. Put ports into VLANs

interface fa0/1
 switchport mode access
 switchport access vlan 10
interface fa0/2
 switchport mode access
 switchport access vlan 20

Setting the mode to access tells the port it connects to one end device and belongs to one VLAN. Notice that you can type interface fa0/2 while still inside fa0/1: the switch simply moves you to the new interface.

5. Build a trunk

interface gi0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

A trunk carries several VLANs between switches by tagging each frame. Allowing only the VLANs you need is good practice. Check it with show interfaces trunk.

6. Shut what you do not use

interface range fa0/5 - 24 then shutdown disables twenty unused ports at once. Unused, enabled ports are an open door for anyone who plugs in a cable.

7. Management address, password and save

interface vlan 10
 ip address 192.168.10.2 255.255.255.0
 no shutdown
exit
enable secret YourStrongPassword
end
copy running-config startup-config

A Layer 2 switch gets its IP address on a VLAN interface, not on a physical port. enable secret protects privileged mode with a hashed password. Finally, the running configuration lives in memory and disappears on reboot until you copy it to the startup configuration (or type write memory).

What to do next

Press Reset lab and do it again without the hints. Then read VLANs and trunks and IOS CLI basic configuration to understand the why behind each step, and try the Packet Tracer VLAN lab when you are ready for a full topology.