Lab: basic switch configuration and SSH access

Aim and what you need

The aim is to take a switch from factory defaults to a secured, remotely manageable device. This is the first thing you do with any switch at work, and it appears in almost every CCNA practical.

• Packet Tracer (or a real Cisco 2960/9200 switch in your own lab, with a console cable).
• One switch, one router (optional, for the gateway) and one PC.
• The template from the first Packet Tracer lab is a good starting point.

Topology and plan

The switch itself does not need an IP address to forward frames. It needs one only so that you can manage it remotely. On a Layer 2 switch that address lives on a switched virtual interface (SVI), here VLAN 1. In real networks you would use a dedicated management VLAN instead of VLAN 1; the VLAN lab shows how.

Steps

1. Connect the PC's RS-232 port to the switch console port with a console cable, open Desktop, Terminal and accept the defaults (9600 baud).
2. Enter the basic settings: hostname, privileged password, console password and banner.
3. Give VLAN 1 an address and set the default gateway so the switch can reply to other subnets.
4. Create a local user, generate RSA keys and turn on SSH version 2.
5. Lock the VTY lines to SSH only and save.

enable
configure terminal
hostname S1
no ip domain-lookup
enable secret <choose-a-strong-secret>
service password-encryption
banner motd # Authorised access only. Activity is logged. #
line console 0
 password <console-password>
 login
 exec-timeout 5 0
 logging synchronous
exit
interface vlan 1
 ip address 192.168.10.2 255.255.255.0
 no shutdown
exit
ip default-gateway 192.168.10.1
ip domain-name lab.example.com
username admin privilege 15 secret <admin-password>
crypto key generate rsa general-keys modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
line vty 0 15
 transport input ssh
 login local
 exec-timeout 10 0
end
copy running-config startup-config

Tip: a hostname and a domain name must exist before the RSA key can be generated. If the simulator asks for the key size instead of accepting it on the command line, enter 2048.

Verify

From the switch, check that SSH is enabled at version 2 and that VLAN 1 is up/up. From the PC command prompt, connect over SSH; success is a login prompt, the banner, and the S1# prompt after you enter the admin password. A Telnet attempt to the same address should be refused.

show ip ssh
show ip interface brief
show running-config | section line vty
show ssh

ping 192.168.10.2
ssh -l admin 192.168.10.2
telnet 192.168.10.2

Troubleshooting and clean-up

• SSH refused: check show ip ssh. If it says disabled, the RSA key was not created; set the domain name and generate it again.
• Cannot ping the switch: VLAN 1 may be administratively down, or the PC is in a different subnet with no gateway set on the switch.
• Login fails on VTY: login local uses the username database, not the line password. Check the username exists.
• Locked out of a real switch: use the password recovery procedure for your model, which needs physical console access.

To reset a lab switch to defaults, erase the startup configuration and the VLAN database, then reload. In Packet Tracer you can also just keep a saved copy of the clean file.

write erase
delete flash:vlan.dat
reload