This post (if not for more my benefit) is a brief list of commands to get people started on performing some basic administration tasks with cisco’s IOS CLI – which accompanies a great deal of the switches.
The “enable” command takes you into administrative mode, to do this enter the following at prompt:
enable
We can view switch information for diagnostic purposes:
show mac-address-table # Shows mac address table show interfaces # Shows interfaces information show running-config # Shows the current saved / active configuration
We wish to enter the configuration mode, so we simply enter the following (where “terminal” represents where we are configuring from):
configure terminal
We can now configure a port as follows (port 1 will be used in the following example):
interface fastethernet0/1 duplex auto # Set automatic duplex configuration (present by default) shutdown # Shutdown the port speed auto # Set automatic speed configuration (present by default)
Changing / Setting the router / switch hostname:
enable configure terminal hostname MYHOSTNAME exit # Exit config mode exit # Exit config line mode write # Write changes to switch
Setting passwords for specific user levels / modes:
enable configure terminal enable password yourpasswordhere # Set password for elevated mode exit # Exit config mode exit # Exit config line mode write # Write changes to switch
Port-Security
Trunked ports can not use “port-security”! So we need to change the trunk port to an access port by doing the following:
interface fastethernet0/1 switchport mode access # Change to access mode switchport port-security # Enables port security (not configured though!) switchport port-security mac-address AA:BB:CC:DD:EE:FF # Sets the mac address that will be accepted in this port switchport port-security maximum # Lets you define how many secure mac addresses there can be (it is only one be default!) switchport port-security violation shutdown (default action - if violation found, port is closed and info send to log , port will need to be manually reopened!) or switchport port-security violation restrict # Drops violating frames, sends info to log, but doesn't shut down port or switchport port-security violation protect # Simply drops frames, does not send anything to log
If you do not know the mac-address to set in port-security you can use sticky ports, instead of predefining a mac address you can use:
switchport port-security mac-address
The first source mac address learned on the port will be the secure mac-address.
We can review the changes made by doing the following:
enable configure terminal show port-security interface fastethernet0/1
To disable trunking on a port:
enable configure terminal interface FastEthernet0/10 no switchport mode trunk no switchport trunk encapsulation no switchport trunk allowed vlan no switchport trunk native vlan switchport mode access exit
To enable / disable STP (Spanning Tree Protocol) on a specific VLAN:
enable configure terminal span vlan 10 exit
or to disable
enable configure terminal no span vlan 10 exit
Get a brief list of ports / info:
[/bash] And finally to save any changes made use: 1write memory
Switch Security
Setting a password for the console:
You can review the current switch configuration by doing:
enable show running-config
We can now set the password:
line con 0 password yourpasswordhere login exit # Exit config mode exit # Exit config line mode write # Write changes to switch
Setup TELNET / SSH Access Password (VTY):
enable configure terminal line vty 0 4 # Use this line password yourpasswordhere # Set password login exit # Exit config mode exit # Exit config line mode write # Write configuration
