Cisco CCNA Preparation · lesson 13 of 36 · 25 min
Initial Switch Setup
A new Cisco switch ships with a default configuration. Before deploying it, you must secure it and configure management access. The CCNA exam tests these commands extensively — you need to know them from memory.
All configuration is done in global configuration mode (configure terminal or conf t). Changes take effect immediately but are lost on reboot unless saved with copy running-config startup-config (or wr).
Hostname and Passwords
enable secret vs enable password
enable secret uses MD5 hashing and always takes precedence over enable password (which stores in plaintext or weak Type 7 encryption). Always use enable secret. service password-encryption applies Type 7 to other passwords but does NOT affect enable secret.
SSH Configuration
Telnet sends all data including passwords in plaintext — never use it in production. SSH encrypts the management session. Configuring SSH requires a domain name and RSA key pair.
Configure SSH-only management access on a new switch
Set hostname and domain name hostname SW1 then ip domain-name Tech Camp for Kids.com — both required before generating the RSA key. Generate RSA key pair crypto key generate rsa modulus 2048 — 2048-bit minimum. This enables SSH automatically. Set SSH version 2 ip ssh version 2 — version 1 has known vulnerabilities. Create local user username admin privilege 15 secret Cisco123! — privilege 15 = full access. Configure VTY lines line vty 0 15 → transport input ssh → login local — SSH only; authenticate against local user database. Verify show ip ssh — confirms SSH is enabled and version 2. show ssh — shows active SSH sessions.
Complete SSH hardening config
Management IP and Default Gateway
A Layer 2 switch needs a management IP address so administrators can SSH into it. This is configured on the VLAN 1 SVI (or a dedicated management VLAN SVI). A default gateway is also required so the switch can be reached from other networks.
Login Banners
Banners display messages to users connecting to the device. The MOTD (Message of the Day) banner appears before login — it should contain a legal warning (not a welcome message, which could be used against you legally). The login banner appears after the MOTD but before the password prompt.
Saving and Verifying
Knowledge Check — 10 Questions
Switch Configuration
Which command encrypts the enable password using a stronger hash than service password-encryption?
- enable password
- enable secret
- service password-encryption
- security passwords
Answer: enable secret
enable secret uses MD5 hashing and always takes precedence over enable password. service password-encryption only applies weak Type 7 encoding to other passwords.
What is required before you can generate an RSA key for SSH?
- A VLAN must be configured
- An IP domain name must be set
- Telnet must be disabled
- A username must exist
Answer: An IP domain name must be set
The RSA key generation uses the hostname + domain name to create the key pair. ip domain-name must be set before crypto key generate rsa.
Which VTY command restricts management access to SSH only?
- transport input telnet
- transport input ssh
- transport input all
- login ssh
Answer: transport input ssh
transport input ssh on the VTY lines allows only SSH connections. transport input telnet would allow only Telnet. transport input all allows both.
Where is the management IP address configured on a Layer 2 switch?
- On a physical interface
- On the VLAN 1 SVI (or management VLAN SVI)
- On the console port
- In global configuration mode directly
Answer: On the VLAN 1 SVI (or management VLAN SVI)
Layer 2 switches do not route, so the management IP goes on an SVI (interface vlan 1 or a dedicated management VLAN). A default gateway is also needed.
What command saves the running configuration so it survives a reboot?
- save config
- write memory (or copy running-config startup-config)
- commit
- store running-config
Answer: write memory (or copy running-config startup-config)
copy running-config startup-config (abbreviated wr) saves the current config to NVRAM. Without this, all changes are lost on reboot.
What is the purpose of the MOTD banner?
- Welcome message for administrators
- Legal warning displayed before login to all connecting users
- Password hint
- System status message
Answer: Legal warning displayed before login to all connecting users
MOTD (Message of the Day) should contain a legal warning about authorised access only — not a welcome message, which could imply open access.
What RSA key size is recommended for SSH on Cisco IOS?
- 512 bits
- 1024 bits
- 2048 bits
- 4096 bits
Answer: 2048 bits
Cisco recommends 2048-bit RSA keys for SSH. 1024-bit is the minimum but is considered weak. Use crypto key generate rsa modulus 2048.
Which command shows all interfaces and their current status (connected/not connected) on a switch?
- show ip interface brief
- show interfaces status
- show vlan brief
- show running-config
Answer: show interfaces status
show interfaces status displays all switch ports with their status (connected/notconnect), VLAN, duplex, speed, and type in a compact table.
The command ip default-_____ sets the default gateway on a Layer 2 switch.
Answer: gateway
ip default-gateway [IP] tells the switch where to send traffic destined for networks it cannot reach directly — needed for remote management.
What does service password-encryption do?
- Encrypts enable secret with MD5
- Applies Type 7 (weak) encoding to plaintext passwords in the config
- Enables SSH encryption
- Encrypts all traffic on the switch
Answer: Applies Type 7 (weak) encoding to plaintext passwords in the config
service password-encryption applies Cisco Type 7 encoding to passwords like console and VTY passwords. It is weak (easily reversed) but prevents casual shoulder-surfing of the config.
Previous lesson: Inter-VLAN routing: router-on-a-stick, Layer 3 switch SVIs, configuration
Back to Cisco CCNA Preparation
Next lesson: Rapid PVST+: root bridge, port states, PortFast, BPDU guard, root guard, loop guard