Cisco switch commands: VLANs, trunks and port security
In short: A quick reference of the Cisco IOS commands used to build and secure an access switch. Commands only.
Commands only. Replace values in angle brackets such as <ip> with your own. Only run commands on systems you own or are authorised to manage.
Basic setup and secure management
enable
configure terminal
hostname SW1
enable secret <strong-secret>
service password-encryption
banner motd #Authorised access only#
no ip domain-lookup
username admin privilege 15 secret <strong-secret>
ip domain-name <domain>
crypto key generate rsa modulus 2048
ip ssh version 2
line console 0
login local
exec-timeout 5 0
line vty 0 15
login local
transport input ssh
exec-timeout 5 0
interface vlan 99
ip address <ip> <mask>
no shutdown
ip default-gateway <gateway-ip>
end
copy running-config startup-configVLANs and access ports
vlan 10
name STAFF
vlan 20
name VOICE
vlan 99
name MGMT
interface range fastEthernet 0/1 - 12
switchport mode access
switchport access vlan 10
switchport voice vlan 20
switchport nonegotiate
spanning-tree portfast
spanning-tree bpduguard enableTrunks
interface gigabitEthernet 0/1
switchport mode trunk
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20,99
switchport nonegotiatePort security and unused ports
interface fastEthernet 0/5
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
interface range fastEthernet 0/13 - 24
switchport mode access
switchport access vlan 999
shutdownDHCP snooping and dynamic ARP inspection
ip dhcp snooping
ip dhcp snooping vlan 10,20
no ip dhcp snooping information option
interface gigabitEthernet 0/1
ip dhcp snooping trust
ip arp inspection trust
interface range fastEthernet 0/1 - 12
ip dhcp snooping limit rate 10
ip arp inspection vlan 10,20Verification commands
| Command | Purpose |
|---|---|
show running-config | Current configuration |
show vlan brief | VLANs and their access ports |
show interfaces trunk | Trunk ports, native and allowed VLANs |
show interfaces status | Port status, VLAN, speed and duplex |
show mac address-table | Learned MAC addresses per port |
show port-security interface <int> | Port security state and violation count |
show ip dhcp snooping binding | DHCP snooping binding table |
show ip arp inspection vlan <id> | DAI status for a VLAN |
show spanning-tree | STP root, roles and states |
show ip ssh | SSH version and status |
errdisable recovery cause psecure-violation | Auto-recover ports shut by port security |
Real-world example: a rogue DHCP server in a college lab
In a further education college, students in one computer lab suddenly lost internet access. Their PCs had addresses in 192.168.0.0/24 instead of the lab's 10.20.30.0/24 range. A student had plugged in a home router to get extra ports, and its built-in DHCP server was answering faster than the college's real server.
The network technician found the router's port with show mac address-table, shut it down and removed the device. To stop it happening again she enabled DHCP snooping on the lab VLAN, marked only the uplink to the core as trusted, and added PortFast with BPDU Guard and port security on every student port. When the same thing was tried a term later, the rogue DHCP offers were dropped and the lab carried on working.
Key takeaways
- Manage switches only over SSH with local or AAA accounts.
- Set access ports explicitly, disable DTP and enable PortFast with BPDU guard.
- Use an unused native VLAN and restrict allowed VLANs on trunks.
- Shut unused ports and apply port security, DHCP snooping and DAI.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.