Switches

Multilayer Switching

Multilayer switches can perform Layer 3 routing. To enable routing on a port, you must disable the switchport functionality.

Convert Switchport to Routed Port

Disable switchport mode to enable Layer 3 routing:

> enable
# config terminal
(config)# interface <interface>
(config-if)# no switchport
(config-if)# ip address <IP> <subnet>
(config-if)# no shutdown

Example:

(config)# interface gigabitEthernet 1/0/1
(config-if)# no switchport
(config-if)# ip address 10.0.0.1 255.255.255.0
(config-if)# no shutdown

Verify Switchport Status

Check if an interface is operating as a switchport or routed port:

# show interfaces <interface> switchport

If the output shows “Switchport: Disabled”, the port is operating at Layer 3.

Basic Switch Configuration

Initial Setup

enable
config terminal

Global Configuration

Set the hostname (recommended to do this first):

(config)# hostname <hostname>

Set privileged EXEC password and enable encryption:

(config)# enable secret <password>
(config)# service password-encryption

Configure default gateway for the switch:

(config)# ip default-gateway <gateway_ip>

Example:

(config)# hostname SW1
(config)# enable secret Cisco123
(config)# service password-encryption
(config)# ip default-gateway 192.168.1.1

Management Interface Configuration

Configure VLAN 1 for management access:

(config)# interface vlan 1
(config-if)# ip address <ip> <subnet>
(config-if)# no shutdown
(config-if)# exit

Example:

(config)# interface vlan 1
(config-if)# ip address 192.168.1.10 255.255.255.0
(config-if)# no shutdown

VTY Line Configuration (Remote Access)

Configure password for Telnet/SSH access:

(config)# line vty 0 15
(config-line)# password <password>
(config-line)# login
(config-line)# exit

Save Configuration

(config)# exit
# copy running-config startup-config

EtherChannel Configuration

Configure EtherChannel with LACP

Select a range of interfaces and configure them as an EtherChannel:

# config terminal
(config)# interface range gigabitEthernet 0/1 - 2
(config-if-range)# switchport trunk encapsulation dot1q
(config-if-range)# switchport mode trunk
(config-if-range)# channel-group 1 mode active

Channel-group modes:

• active: LACP - actively negotiates
• passive: LACP - waits for negotiation
• desirable: PAgP - actively negotiates
• auto: PAgP - waits for negotiation
• on: Static - no negotiation protocol

Example:

(config)# interface range gigabitEthernet 0/1 - 2
(config-if-range)# switchport mode trunk
(config-if-range)# channel-group 1 mode active

Configure EtherChannel for Access Ports

For non-trunked EtherChannels, configure ports in access mode:

(config)# interface range fastEthernet 0/1 - 2
(config-if-range)# switchport mode access
(config-if-range)# switchport access vlan 10
(config-if-range)# channel-group 2 mode active

EtherChannel Verification Commands

Display EtherChannel summary:

# show etherchannel summary

Display detailed port-channel information:

# show etherchannel <group_number> port-channel
# show interfaces port-channel <number>
# show interfaces etherchannel

Verify EtherChannel is operating as a single interface in STP:

# show spanning-tree

PortFast Configuration

PortFast allows edge ports (connected to end devices) to skip STP listening/learning states and immediately transition to forwarding.

Enable PortFast on Interface

(config)# interface <interface>
(config-if)# spanning-tree portfast

Example:

(config)# interface fastEthernet 0/5
(config-if)# spanning-tree portfast

Enable PortFast Globally (All Access Ports)

(config)# spanning-tree portfast default

Warning: Only enable PortFast on ports connected to end devices (PCs, servers, printers). Never enable PortFast on ports connected to other switches, as it bypasses loop prevention.

Port Security

Port security restricts which devices can connect to a switchport based on MAC address.

Configure Port Security with Sticky MAC

enable
config terminal
(config)# interface <interface>

Put port in access mode (required for port security):

(config-if)# switchport mode access

Enable port security:

(config-if)# switchport port-security

Learn and save MAC addresses dynamically:

(config-if)# switchport port-security mac-address sticky

Limit the number of allowed MAC addresses:

(config-if)# switchport port-security maximum <1-8192>

Configure violation action:

(config-if)# switchport port-security violation <shutdown|restrict|protect>

Violation modes:

• shutdown: Disables the port (default, most secure)
• restrict: Drops packets and logs violations
• protect: Drops packets silently (no log)

Complete Example:

(config)# interface fastEthernet 0/5
(config-if)# switchport mode access
(config-if)# switchport port-security
(config-if)# switchport port-security mac-address sticky
(config-if)# switchport port-security maximum 1
(config-if)# switchport port-security violation shutdown

Manually Configure Allowed MAC Address

Instead of sticky learning, manually specify allowed MAC addresses:

(config-if)# switchport port-security mac-address <mac_address>

Example:

(config-if)# switchport port-security mac-address 0050.5682.1234

Port Security Verification Commands

# show port-security
# show port-security interface <interface>
# show port-security address

Recover from Security Violation

If a port is shut down due to a violation (err-disabled state):

(config)# interface <interface>
(config-if)# shutdown
(config-if)# no shutdown

Or enable automatic recovery:

(config)# errdisable recovery cause psecure-violation
(config)# errdisable recovery interval <seconds>

VLAN Configuration

Show VLAN Information

Display all VLANs (brief):

# show vlan brief

Display specific VLAN information:

# show vlan id <vlan_number>

Create and Name VLANs

enable
# config terminal
(config)# vlan <vlan_number>
(config-vlan)# name <vlan_name>
(config-vlan)# exit

Example:

(config)# vlan 10
(config-vlan)# name SALES
(config-vlan)# exit

(config)# vlan 20
(config-vlan)# name ENGINEERING
(config-vlan)# exit

Assign Ports to VLANs

Assign a single port:

(config)# interface <interface>
(config-if)# switchport mode access
(config-if)# switchport access vlan <vlan_number>

Assign a range of ports:

(config)# interface range <interface_range>
(config-if-range)# switchport mode access
(config-if-range)# switchport access vlan <vlan_number>
(config-if-range)# exit

Example:

(config)# interface range fastEthernet 0/1 - 10
(config-if-range)# switchport mode access
(config-if-range)# switchport access vlan 10

Assign IP Address to VLAN (SVI)

Configure a Switch Virtual Interface (SVI) for inter-VLAN routing or management:

(config)# interface vlan <vlan_number>
(config-if)# ip address <ip_address> <subnet_mask>
(config-if)# no shutdown

Example:

(config)# interface vlan 10
(config-if)# ip address 192.168.10.1 255.255.255.0
(config-if)# no shutdown

Delete VLAN

(config)# no vlan <vlan_number>

VLAN Trunking

Trunk ports carry traffic for multiple VLANs between switches.

Show Trunk Information

# show interfaces trunk

Configure Trunk Port

enable
# config terminal
(config)# interface <interface>
(config-if)# switchport mode trunk
(config-if)# switchport trunk native vlan <vlan_number>
(config-if)# switchport trunk allowed vlan <vlan_list>
(config-if)# no shutdown

Example:

(config)# interface gigabitEthernet 0/1
(config-if)# switchport mode trunk
(config-if)# switchport trunk native vlan 99
(config-if)# switchport trunk allowed vlan 10,20,30
(config-if)# no shutdown

Configure Trunk on Interface Range

(config)# interface range <interface_range>
(config-if-range)# switchport mode trunk
(config-if-range)# switchport trunk native vlan <vlan_number>
(config-if-range)# switchport trunk allowed vlan <vlan_list>
(config-if-range)# no shutdown
(config-if-range)# exit

Example:

(config)# interface range fastEthernet 0/23 - 24
(config-if-range)# switchport mode trunk
(config-if-range)# switchport trunk native vlan 99
(config-if-range)# switchport trunk allowed vlan 10,20,30,99
(config-if-range)# no shutdown

Trunk Encapsulation (on switches that support it)

Some switches require you to specify trunk encapsulation type:

(config-if)# switchport trunk encapsulation dot1q
(config-if)# switchport mode trunk

Trunk Mode Options

• trunk: Port is permanently in trunking mode
• access: Port is permanently in access mode
• dynamic auto: Port waits for the neighbor to initiate trunking
• dynamic desirable: Port actively attempts to negotiate trunking

Example:

(config-if)# switchport mode dynamic desirable

Modify Allowed VLANs on Trunk

Add VLANs to the allowed list:

(config-if)# switchport trunk allowed vlan add <vlan_list>

Remove VLANs from the allowed list:

(config-if)# switchport trunk allowed vlan remove <vlan_list>

Allow all VLANs:

(config-if)# switchport trunk allowed vlan all

Example:

(config-if)# switchport trunk allowed vlan add 40,50
(config-if)# switchport trunk allowed vlan remove 30

MAC Address Table Management

Show MAC Address Table

Display all learned MAC addresses:

# show mac address-table

Display MAC addresses for a specific VLAN:

# show mac address-table vlan <vlan_number>

Display MAC addresses on a specific interface:

# show mac address-table interface <interface>

Clear MAC Address Table

Clear the entire MAC address table:

# clear mac address-table

Clear only dynamically learned entries (preserves static entries):

# clear mac address-table dynamic

Configure Static MAC Address Entry

Manually assign a MAC address to a VLAN and interface (not recommended for production):

# mac address-table static <mac_address> vlan <vlan_number> interface <interface>

Example:

# mac address-table static 0050.5682.1234 vlan 10 interface fastEthernet 0/5

Voice VLAN Configuration

Configure Voice VLAN on Access Port

Configure a port for both data and voice traffic:

(config)# interface <interface>
(config-if)# switchport mode access
(config-if)# switchport access vlan <data_vlan>
(config-if)# switchport voice vlan <voice_vlan>
(config-if)# spanning-tree portfast
(config-if)# mls qos trust cos

Example:

(config)# interface fastEthernet 0/5
(config-if)# switchport mode access
(config-if)# switchport access vlan 10
(config-if)# switchport voice vlan 20
(config-if)# spanning-tree portfast
(config-if)# mls qos trust cos

Voice VLAN on Interface Range

(config)# interface range fastEthernet 0/1 - 24
(config-if-range)# switchport mode access
(config-if-range)# switchport access vlan 10
(config-if-range)# switchport voice vlan 20
(config-if-range)# spanning-tree portfast
(config-if-range)# mls qos trust cos

QoS (Quality of Service) for VoIP

Enable QoS Globally

(config)# mls qos

Trust CoS Values

Trust Class of Service markings from IP phones:

(config-if)# mls qos trust cos

Trust DSCP Values

Trust Differentiated Services Code Point markings:

(config-if)# mls qos trust dscp

Configure Priority Queue

Enable priority queuing for time-sensitive traffic:

(config-if)# priority-queue out

Auto QoS Configuration

Cisco’s simplified QoS configuration for VoIP.

For interfaces connected to Cisco IP phones:

(config-if)# auto qos voip cisco-phone

For trunk ports or interfaces already trusted:

(config-if)# auto qos voip trust

Example:

(config)# interface fastEthernet 0/5
(config-if)# auto qos voip cisco-phone

(config)# interface gigabitEthernet 0/1
(config-if)# auto qos voip trust

QoS Verification Commands

# show mls qos
# show mls qos interface <interface>
# show mls qos interface <interface> statistics
# show auto qos

Power over Ethernet (PoE)

Configure PoE Priority

Set power priority for critical devices:

(config-if)# power inline priority <high|low>

Example:

(config)# interface fastEthernet 0/5
(config-if)# power inline priority high

Set Maximum PoE Power

Limit power allocation per port:

(config-if)# power inline max <milliwatts>

Example:

(config-if)# power inline max 15400

Disable PoE on Interface

Prevent PoE delivery on a port:

(config-if)# power inline never

Enable PoE on Interface

(config-if)# power inline auto

PoE Verification Commands

Display PoE status for all interfaces:

# show power inline

Display PoE status for specific interface:

# show power inline <interface>

Display PoE power budget and consumption:

# show power inline consumption

Example output interpretation:

• Available: Total power budget
• Used: Currently allocated power
• Remaining: Available for additional devices

Private VLAN Configuration

Private VLANs provide Layer 2 isolation between ports in the same VLAN.

Configure Primary VLAN

(config)# vlan <primary_vlan_number>
(config-vlan)# private-vlan primary

Configure Secondary VLANs

(config)# vlan <secondary_vlan_number>
(config-vlan)# private-vlan <isolated|community>

Associate Secondary with Primary

(config)# vlan <primary_vlan_number>
(config-vlan)# private-vlan association <secondary_vlan_list>

Example:

(config)# vlan 100
(config-vlan)# private-vlan primary

(config)# vlan 101
(config-vlan)# private-vlan isolated

(config)# vlan 100
(config-vlan)# private-vlan association 101