Welcome to Scribd, the world's digital library. Read, publish, and share books and documents. See more
Standard view
Full view
of .
Save to My Library
Look up keyword
Like this
0 of .
Results for:
No results containing your search query
P. 1
Configure Cisco Switches

Configure Cisco Switches

Ratings: (0)|Views: 4,400 |Likes:
Published by Jessica Chiang
Handy reference I put together to help setting up a small switched network at work. It documented how I set up Cisco switches for port security, VTP, and VLAN
Handy reference I put together to help setting up a small switched network at work. It documented how I set up Cisco switches for port security, VTP, and VLAN

More info:

Published by: Jessica Chiang on Oct 07, 2009
Copyright:Attribution Non-commercial


Read on Scribd mobile: iPhone, iPad and Android.
download as DOC, PDF, TXT or read online from Scribd
See more
See less





Cisco Switches
Port Security, VLAN, and VTP
Lock Down Cisco Switch Port Security
Configuring the Port Security feature is relatively easy. In its simplest form, port securityrequires going to an already enabled switch port and entering the
Interface Modecommand
Here’s an example:
Switch)# config tSwitch(config)# int fa0/18Switch(config-if)# switchport port-security ?aging Port-security aging commandsmac-address Secure mac addressmaximum Max secure addressesviolation Security violation modeSwitch(config-if)# switchport port-securitySwitch(config-if)#^Z
By entering the most basic command to configure port security, we accepted the default settingsof only allowing one MAC address, determining that MAC address from the first device thatcommunicates on this switch port, and shutting down that switch port if another MAC addressattempts to communicate via the port. But you don’t have to accept the defaults.
Port-Security Options
As you can see in the example, there are a number of other port security commands that you canconfigure. Here are some of your options:
switchport port-security maximum {max # of MAC addressesallowed}
You can use this option to allow more than the default number of MAC addresses, which is one. For example, if you had a 12-port hubconnected to this switch port, you would want to allow 12 MAC addresses —one for each device. The maximum number of secure MAC addresses per portis 132.
switchport port-security violation {shutdown | restrict | protect}
 This command tells the switch what to do when the number of MACaddresses on the port has exceeded the maximum. The default is to shutdown the port. However, you can also choose to alert the networkadministrator (i.e.,
) or only allow traffic from the secure port and droppackets from other MAC addresses (i.e.,
switchport port-security mac-address {MAC address}
You can use thisoption to manually define the MAC address allowed for this port rather thanletting the port dynamically determine the MAC address.
Of course, you can also configure port security on a range of ports. Here’s an example:
Switch)# config tSwitch(config)# int range fastEthernet 0/1 - 24Switch(config-if)# switchport port-security
However, you need to be very careful with this option if you enter this command on an uplink  port that goes to more than one device. As soon as the second device sends a packet, the entire port will shut down.
View the status of port security
Once you’ve configured port security and the Ethernet device on that port has sent traffic, theswitch will record the MAC address and secure the port using that address. To find out the statusof port security on the switch, you can use the
 show port-security address
 show port-securityinterface
commands. Below are examples for each command’s output:
Switch# show port-security addressSecure Mac Address Table-------------------------------------------------------------------Vlan Mac Address Type Ports Remaining Age(mins)---- ----------- ---- ----- -------------1 0004.00d5.285d SecureDynamic Fa0/18 --------------------------------------------------------------------Total Addresses in System (excluding one mac per port) : 0Max Addresses limit in System (excluding one mac per port) : 1024Switch# show port-security interface fa0/18Port Security : EnabledPort Status : Secure-upViolation Mode : ShutdownAging Time : 0 minsAging Type : AbsoluteSecureStatic Address Aging : DisabledMaximum MAC Addresses : 1Total MAC Addresses : 1Configured MAC Addresses : 0Sticky MAC Addresses : 0Last Source Address : 0004.00d5.285dSecurity Violation Count : 0Switch#
Select multiple ports to configure
Switch1#enableSwitch1(config)#interface range gigabitEthernet 0/1 – 20Switch1(config-if-range)#spanning-tree portfastSwitch1(config-if-range)#switchport mode trunkSwitch1(config-if-range)#^ZSwitch1# copy running-configuration startup-configurationSwitch1#show running-configuration
Set up VLAN
VLANs are Virtual LANs. They allow you to logically divide up your switched network toimprove network speed, security, and reliability. If you have other Cisco equipment in your network, such as Cisco wireless access points or Cisco PIX firewalls, setting up your switchcorrectly will give you a big return as all the Cisco equipment is VLAN aware. What does thismean? it means you can have two networks shared out via wireless using one access point. It alsomeans you can separate out sections of your network for servers, clients, VPN clients, etc.. whichwill greatly improve your network efficiency.Before you begin defining VLANs on your network, first decide what the purpose is for eachVLAN. For example, let’s say we have two offices: one in San Diego, and another in San Diego.At each location we want to separate out Servers and clients. This means we have 4 categories:
SD_Servers /
SD_Clients /
LA_Servers /
LA_Clients. / our example, we will set up each VLAN with the above IP configuration. The IP configurationtells the switch what network segments are where which will allow your switch to do routing between VLANs.

Activity (101)

You've already reviewed this. Edit your review.
1 hundred reads
1 thousand reads
Hans Hamels added this note
Thanks for this.Really helpful :)
Javier Revilla liked this
whereisdhanu liked this
Syed Jibraan liked this
mathone liked this
surajhari liked this

You're Reading a Free Preview

/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->