Choosing switches and routers, and configuring them for the first time

Types of switch

Types of router and how to choose

Routers connect networks and choose the best path for each packet. You will meet branch routers for small sites, network edge routers where an organisation meets its providers, service provider routers that carry huge volumes, and both fixed and modular designs.

When you choose any network device, compare: cost, number and speed of ports, forwarding rate, Power over Ethernet, features such as QoS and security, room to grow, how it is managed and monitored, and the vendor's support and reputation.

Reaching the device

• Console port: a direct cable and terminal software (such as PuTTY or Tera Term). Works even with no network configuration, so it is used for first setup and recovery.
• SSH: encrypted remote access over the network. The right choice for day-to-day management.
• Telnet: remote access in clear text. Avoid it: passwords can be captured.
• AUX port: an older out-of-band port, once used with a modem.

The IOS command modes

A secure first-time configuration

enable
configure terminal
hostname BR1-RTR
ip domain-name example.local
no ip domain-lookup
enable secret Str0ng-Enable-Pass
username netadmin privilege 15 secret Str0ng-User-Pass
service password-encryption
banner login #Authorised users only. Activity is logged.#
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 4
 login local
 transport input ssh
end
copy running-config startup-config

• no ip domain-lookup stops the device trying to resolve mistyped commands as host names.
• Always use enable secret (stored as a strong hash) rather than enable password.
• service password-encryption only hides passwords lightly from people looking over your shoulder; it is not strong encryption.

Real-world example: a new branch switch on the bench

A logistics firm shipped a new 24-port access switch to an engineer before a branch opening. Rather than plugging it straight into the live network, the engineer connected a console cable on the bench and applied the company baseline: a hostname that follows the naming standard, an enable secret, a local admin account, a login banner, password encryption, an SSH key, Telnet disabled and the management VLAN address.

The engineer checked SSH access from a laptop, saved the configuration and backed it up to the configuration server. Unused ports were shut down before the switch left the bench. On site, the installer only had to rack it and connect the uplink, and the switch appeared in monitoring within minutes. Doing the secure first-time configuration in a controlled place meant the device was never on the network with default settings.