Basic switch management
- 1. Basic Switch Management v1.21 – Aaron Balchunas * * * All original material copyright © 2007 by Aaron Balchunas (aaron@routeralley.com), unless otherwise noted. All other material copyright © of their respective owners. This material may be copied and used freely, but may not be altered or sold without the expressed written consent of the owner of the above copyright. Updated material may be found at http://www.routeralley.com. 1 - Basic Switch Management - Catalyst Operating Systems Catalyst switches, depending on the model, support one of two possible operating systems: • Catalyst OS (CatOS) • IOS The CatOS is an antiquated interface based on “set” commands. Retired Catalyst models such as the 40xx and 50xx series supported the CatOS interface. Modern Catalyst switches support the Cisco IOS, enhanced with switching- specific commands. Catalyst models that support the Cisco IOS include: • 29xx series • 35xx series • 37xx series • 45xx series • 49xx series • 65xx series The Cisco IOS interface on Catalyst switches is nearly identical to that of the router IOS (with the exception of the switching-specific commands). The IOS is covered in great detail in other guides on this site, specifically: • Router Components • Introduction to the Cisco IOS • Advanced IOS Functions Some basic IOS concepts will be reviewed in this guide. For more comprehensive information, please consult the above guides.
- 2. Basic Switch Management v1.21 – Aaron Balchunas * * * All original material copyright © 2007 by Aaron Balchunas (aaron@routeralley.com), unless otherwise noted. All other material copyright © of their respective owners. This material may be copied and used freely, but may not be altered or sold without the expressed written consent of the owner of the above copyright. Updated material may be found at http://www.routeralley.com. 2 Using Lines to Configure the IOS Three methods (or lines) exist to configure Cisco IOS devices (including Catalyst switches): • Console ports • Auxiliary ports • VTY (telnet) ports Nearly every modern Cisco router or switch includes a console port, sometimes labeled on the device simply as con. The console port is generally a RJ-45 connector, and requires a rollover cable to connect to. The opposite side of the rollover cable connects to a PC’s serial port using a serial terminal adapter. From the PC, software such as HyperTerminal is required to make a connection from the local serial port to the router console port. The following settings are necessary for a successful connection: • Bits per second - 9600 baud • Data bits - 8 • Parity - None • Stop bits - 1 • Flow Control - Hardware Some Cisco devices include an auxiliary port, in addition to the console port. The auxiliary port can function similarly to a console port, and can be accessed using a rollover cable. Additionally, auxiliary ports support modem commands, thus providing dial-in access to Cisco devices. Telnet, and now SSH, are the most common methods of remote access to routers and switches. The standard edition of the IOS supports up to 5 simultaneous VTY connections. Enterprise editions of the IOS support up to 255 VTY connections. There are two requirements before a Catalyst switch will accept a VTY connection: • An IP address must be configured on the Management VLAN (by default, this is VLAN 1) • At least one VTY port must be configured with a password
- 3. Basic Switch Management v1.21 – Aaron Balchunas * * * All original material copyright © 2007 by Aaron Balchunas (aaron@routeralley.com), unless otherwise noted. All other material copyright © of their respective owners. This material may be copied and used freely, but may not be altered or sold without the expressed written consent of the owner of the above copyright. Updated material may be found at http://www.routeralley.com. 3 IOS Modes on Cisco Catalyst Switches The Cisco IOS is comprised of several modes, each of which contains a set of commands specific to the function of that mode. By default, the first mode you enter when logging into a Cisco device is User EXEC mode. User mode appends a “>” after the device hostname: Switch> No configuration can be changed or viewed from User mode. Only basic status information can be viewed from this mode. Privileged EXEC mode allows all configuration files, settings, and status information to be viewed. Privileged mode appends a “#” after the device hostname: Switch# To enter Privileged mode, type enable from User mode: Switch> enable Switch# To return back to User mode from Privileged mode, type disable: Switch# disable Switch> Very little configuration can be changed directly from Privileged mode. Instead, to actually configure the Cisco device, one must enter Global Configuration mode: Switch(config)# To enter Global Configuration mode, type configure terminal from Privileged Mode: Switch# configure terminal Switch(config)# To return back to Privileged mode, type exit: Switch(config)# exit Switch#
- 4. Basic Switch Management v1.21 – Aaron Balchunas * * * All original material copyright © 2007 by Aaron Balchunas (aaron@routeralley.com), unless otherwise noted. All other material copyright © of their respective owners. This material may be copied and used freely, but may not be altered or sold without the expressed written consent of the owner of the above copyright. Updated material may be found at http://www.routeralley.com. 4 IOS Modes on Cisco Catalyst Switches (continued) As its name implies, Global Configuration mode allows parameters that globally affect the device to be changed. Additionally, Global Configuration mode is sectioned into several sub-modes dedicated for specific functions. Among the most common sub-modes are the following: • Interface Configuration mode - Switch(config-if)# • Line Configuration mode - Switch(config-line)# Recall the difference between interfaces and lines. Interfaces connect routers and switches to each other. In other words, traffic is actually routed or switched across interfaces. Examples of interfaces include Serial, ATM, Ethernet, Fast Ethernet, and Token Ring. To configure an interface, one must specify both the type of interface, and the interface number (which always begins at “0”). Thus, to configure the first Ethernet interface on a router: Switch(config)# interface ethernet 0 Switch(config-if)# Lines identify ports that allow us to connect into, and then configure, Cisco devices. Examples would include console ports, auxiliary ports, and VTY (or telnet) ports. Just like interfaces, to configure a line, one must specify both the type of line, and the line number (again, always begins at “0”). Thus, to configure the first console line on a switch: Switch(config)# line console 0 Switch(config-line)# Multiple telnet lines can be configured simultaneously. To configure the first sixteen telnet (or VTY) lines on a switch: Switch(config)# line vty 0 15 Switch(config-line)# Notice that Catalyst switches natively support up to 16 VTY connections. A Cisco router running the standard IOS supports up to 5 VTY connections. Remember that the numbering for both interfaces and lines begins with “0.”
- 5. Basic Switch Management v1.21 – Aaron Balchunas * * * All original material copyright © 2007 by Aaron Balchunas (aaron@routeralley.com), unless otherwise noted. All other material copyright © of their respective owners. This material may be copied and used freely, but may not be altered or sold without the expressed written consent of the owner of the above copyright. Updated material may be found at http://www.routeralley.com. 5 Enable Passwords The enable password protects a switch’s Privileged mode. This password can be set or changed from Global Configuration mode: Switch(config)# enable password MYPASSWORD Switch(config)# enable secret MYPASSWORD2 The enable password command sets an unencrypted password intended for legacy systems that do not support encryption. It is no longer widely used. The enable secret command sets an MD5-hashed password, and thus is far more secure. The enable password and enable secret passwords cannot be identical. The switch will not accept identical passwords for these two commands. Line Passwords and Configuration Passwords can additionally be configured on switch lines, such as telnet (vty), console, and auxiliary ports. To change the password for a console port and all telnet ports: Switch(config)# line console 0 Switch(config-line)# login Switch(config-line)# password cisco1234 Switch(config-line)# exec-timeout 0 0 Switch(config-line)# logging synchronous Switch(config)# line vty 0 15 Switch(config-line)# login Switch(config-line)# password cisco1234 Switch(config-line)# exec-timeout 0 0 Switch(config-line)# logging synchronous The exec-timeout 0 0 command is optional, and disables the automatic timeout of your connection. The two zeroes represent the timeout value in minutes and seconds, respectively. Thus, to set a timeout for 2 minutes and 30 seconds: Switch(config-line)# exec-timeout 2 30 The logging synchronous command is also optional, and prevents system messages from interrupting your command prompt. By default, line passwords are stored in clear-text in configuration files. To ensure these passwords are encrypted in all configuration files: Switch(config)# service password–encryption
- 6. Basic Switch Management v1.21 – Aaron Balchunas * * * All original material copyright © 2007 by Aaron Balchunas (aaron@routeralley.com), unless otherwise noted. All other material copyright © of their respective owners. This material may be copied and used freely, but may not be altered or sold without the expressed written consent of the owner of the above copyright. Updated material may be found at http://www.routeralley.com. 6 Catalyst Configuration Files Like Cisco routers, Catalyst switches employ a startup-config file (stored in NVRAM) and a running-config (stored in RAM). The startup-config is the saved configuration used when a router boots, and the running-config is the currently active configuration. Any configuration change made to an IOS device is made to the running- config. Because the running-config file is stored in RAM, the contents of this file will be lost during a power-cycle. To save the contents of the running-config to the startup-config file: Switch# copy run start Catalyst switches additionally employ the following configuration and diagnostic files, all stored in Flash memory: • vlan.dat • system_env_vars • crashinfo The vlan.dat file contains a list all created VLANs, and includes any VTP specific information. The vlan.dat file does not contain information on interface-to-VLAN assignments (which is stored in the startup-config). The system_env_vars file contains environmental information specific to the Catalyst switch, including serial/model numbers and MAC addresses. The crashinfo file contains memory-dump information about previous switch failures. To delete all files in flash: Switch# erase flash: To delete a specific file in flash: Switch# erase flash:FILENAME To delete a specific file in flash: Switch# format flash: To upload an IOS image file from a TFTP server to flash: Switch# copy tftp: flash:FILENAME
- 7. Basic Switch Management v1.21 – Aaron Balchunas * * * All original material copyright © 2007 by Aaron Balchunas (aaron@routeralley.com), unless otherwise noted. All other material copyright © of their respective owners. This material may be copied and used freely, but may not be altered or sold without the expressed written consent of the owner of the above copyright. Updated material may be found at http://www.routeralley.com. 7 Configuring Telnet Access on Catalyst Switches Recall the two requirements to configure a Catalyst switch for VTY access: • An IP address must be configured on the Management VLAN (by default, this is VLAN 1) • At least one VTY port must be configured with a password. Configuring passwords on VTY lines was covered previously: Switch(config)# line vty 0 15 Switch(config-line)# login Switch(config-line)# password cisco1234 To assign an IP address to the Management VLAN: Switch(config)# interface vlan 1 Switch(config-if)# ip address 192.168.123.151 255.255.255.0 Switch(config-if)# no shut