Cisco Lab

User documentation

  • Last Updated: 07/02/2019

Cisco Lab

By now the user should have completed the "Student Lab Setup" guide found here:

In this lab, you will learn the basics of Cisco routing and switching. The techniques you learn in this lab will show how a single inbound connection can be spread all across a myriad of machines efficiently. The command line interface for Cisco products can be intimidating to beginners, and as such the reader can expect this document to serve as instruction as well as a guide to basic commands.

By the end of this lab the user should be able to remotely access the switch from the server via Ethernet connection.

Accessing a Cisco Switch.

There are two recommended ways for you to access your Cisco switch.

The first is Minicom, a Linux command line Console tool. This guide explains how to use it:

If you are using a Windows machine, read the following guide on how to use puTTY for Console connections:

Choose a method and access the switch's command line now.

Accessing the Switch Terminal

After entering your username (which should be admin) and password (most likely from your teacher), you should get a prompt like so:


This is the command line for the switch. Now enter the following command to access privileged mode:


You are now in privileged mode (if you see the "#" next to the switch name). In this mode, you are able to see the configuration and setup of the switch. However, this mode is not designed to edit that configuration. To actually edit the config of the switch, use the following command:

trainswitch#configure terminal

This is configuration mode. As long as you see the "(config)#", you are able to change the config of the switch.

Viewing Configuration

The whole configuration of the switch is located in a file you can see from this view. To see this file, run

do show run
. Something like the following will appear:

trainswitch(config)#do show run
Building configuration...

Current configuration : 3627 bytes
version 12.1
no service pad
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service linenumber
logging buffered 512000 debugging
no logging console
clock timezone est -5
clock summer-time est recurring
ip subnet-zero

The "Do" command only works in configuration mode. Essentially, it tells the switch to run the following command as opposed to modifying a configuration. "Show run" shows the running configuration seen on the switch.

You can see the rest of the switches config by pressing enter for one line at a time or spacebar for a page at a time. You can exit out of this view by typing another command or CTRL + C.

This is extremely useful with Cisco switches. They are designed to be easy to configure: thus, this isn't just the configuration scheme but also a set of commands to set up a switch. If you copied the whole configuration of a Cisco switch and pasted it in the terminal of a clean switch, they would become identical switches.


SSH is the process of remotely accessing a machine through an encrypted line. To allow SSH into a machine, it must have a key that allows access to encrypt the line. To generate these keys, run the following command. If it prompts you to overwrite old keys, say yes. Use a 1024 bit key. Then run the rest of the commands to ensure SSH is properly configured.

trainswitch(config)#crypto key generate rsa                                     
The name for the keys will be: trainswitch.train.local.                         
% You already have RSA keys defined for trainswitch.train.local..               
% Do you really want to replace them? [yes/no]: yes                             
Choose the size of the key modulus in the range of 360 to 2048 for your         
  General Purpose Keys. Choosing a key modulus greater than 512 may take        
  a few minutes.                                                                

How many bits in the modulus [512]: 1024                                        
Generating RSA keys ...                                                         

trainswitch(config)# ip ssh logging events
trainswitch(config)# ip ssh authentication-retries 2
trainswitch(config)# ip ssh time-out 30
trainswitch(config)# ip ssh version 2

Creating a login for Console

These commands will create a user for anyone requesting access to the switch. Privilege 15 is the highest available, "secret" is a more secure type of password

trainswitch(config)# username admin privilege 15 secret 15.learner
trainswitch(config)# service password-encryption

AAA Commands

AAA stands for Authentication, Authorization, & Accounting. These commands regulate how logins, permissions, and logging are managed. These basic commands are often used for setting up a Cisco device.

trainswitch(config)# service password-encryption

trainswitch(config)# aaa new-model
trainswitch(config)# aaa authentication login default local
trainswitch(config)# aaa authorization exec default local if-authenticated
trainswitch(config)# aaa session-id common

Console Configuration

These commands will effect a user consoling in via the switch's serial port

trainswitch(config)# line con 0
trainswitch(config-line)# session-timeout 60
trainswitch(config-line)# exec-timeout 60 0
trainswitch(config-line)# privilege level 15
trainswitch(config-line)#transport preferred none

These commands will effect a user SSHing in via ethernet

trainswitch(config)# line vty 0 15
trainswitch(config-line)# session-timeout 60
trainswitch(config-line)# exec-timeout 60 0
trainswitch(config-line)# privilege level 15
trainswitch(config-line)#transport preferred none
trainswitch(config-line)#transport input ssh

Vlan Access

In a switch, different ports can have access to different vlans. This allows for the virtual creation of separate networks with no connections to each other. We already set up vlan 60 at the beginning of the year to allow for common internet access. To create or modify a vlan, enter the "int" command followed by the vlan number. Make sure to use a vlan that hasn't been used before; we recommend 70.

To create a vlan on the switch, use the basic command "vlan x" where x is the number vlan you are creating. For example, when making vlan 70:

trainswitch(config)#vlan 70                                               

You have now created vlan 70 on this machine. You know you are in vlan config mode by the "(config-vlan)#" prompt. While you are here, go ahead and give your vlan a name. You can do this like so:

trainswitch(config-vlan)#name test_vlan                                               

In this case, we named our vlan "test_vlan". Exit this specific vlan configuration with the "exit" command like so:


Now you are back in interface mode, once again denoted by the "(config)#" prompt.

There are two ways vlans are edited. You already used the first. The second form edits the vlan as an interface. This allows us to give the vlan layer 3 qualities such as an ip address. To enter interface config of a vlan, use the following:

trainswitch(config)#int vlan 70                                               

You are now in the configuration mode for that vlan, as seen by the "(config-if)#" where "if" is short for interface.

Vlan Settings

There are a few common settings that you can change inside of a vlan. For example, "desc" (or description) allows the user to enter a small phrase describing what that vlan is used for. Give a description to your vlan.

Each vlan also has an ip address. Follow these commands to give the switch an ip address:

trainswitch(config)#int Vlan 70                                               
trainswitch(config-if)# ip address

Finally, we want to enable the vlan. This essentially allows us to turn it on. Use this command:

trainswitch(config-if)#no shutdown

Port Access

If you scrolled down far enough on the switch configuration, you would see that each different port has its own configuration with a variety of settings. You can select a port by running the following command where ? is the port number you wish to access:

trainswitch(config)#int f 0/?

That line also highlights the autocompletion of Cisco devices. If there are no other words that fit the beginnings of the words in a command, Cisco automatically completes the command. The above command is the same as:

trainswitch(config-if)#interface fastEthernet 0/?

Go ahead and select a port that doesn't have anything plugged into it. Type the command above to access its interface config.
NOTE: the ports may be numbered 1/0/x instead of 0/x. Use "show ip interface brief" to check. If so, simply add a 1/ before the 0.

At the beginning of the year, you set up ports 1-8 to begin doing work on labs. Now that you have a little more experience, we will set up the other ports for use.

To select more than one port, we use the "range" keyword. You can configure each port manually, but selecting all of them is much faster. Example:

trainswitch(config)#int ra F 0/9 - 16                                           

Most of the words I used auto-completion on, but you know you selected ports when you see "trainswitch(config-if-range)#" in the parenthesis.

Port Configuration

There are various settings we can apply to ports on a switch. The first is assigning what kind of data it deals with which vlan. We set up vlan 60 for the first few ports at the beginning of the year for common internet traffic, so we will apply our new vlan to the rest of the ports on the switch. To assign a vlan to a port, use the "switchport access" command followed by vlan and the number. Below is an example giving ports 10 through 12 access to vlan 70:

trainswitch(config)#int ran f 0/10 - 12
trainswitch(config-if-range)#switchpo acc vl 70

Now, if you go ahead and plug (or unplug and plug back in) a device to that port, it will take about 30 seconds for the light above the port to turn green, signaling access. (NOTE: if you do this with the machine you are currently working on, you will need to reconnect to the switch!) That a lot slower than you have probably seen in just about every other ethernet port.

Ports connecting have three stages: Listening, learning, and forwarding. During those first 30 seconds the port was listening and learning before it started forwarding. To bypass this delay, we can enable portfast. Portfast allows a port to instantly enter the forwarding stage and allow internet access to the connected device. To enable portfast, use the following command on all ports you use. If you disconnect and reconnect your device, you should see that the orange light turns green much faster.

trainswitch(config-if-range)#spanning-tree portfast trunk

There are two main port types we use. The first is an access port. An access port allows for a straight connection to the source with no complexities. A trunk port, on the other hand, tags the end of packets with a short key. This key states what network is being sent through that line. If you wish to use more than one network or vlan in a single port, trunking must be enabled. You can enable trunking with the "switchport mode" command followed by trunk, but DO NOT do this for your selected ports.

Another useful feature of Cisco switches is the ? in Cisco. If you type

switchport mode ?
into the console, the following will appear:

trainswitch(config-if)#switchport mode ?                                   
  access   Set trunking mode to ACCESS unconditionally                     
  dynamic  Set trunking mode to dynamically negotiate access or trunk mode 
  trunk    Set trunking mode to TRUNK unconditionally

It lists the different options for the command. This works after any incomplete command in Cisco, even if there is no command and only the ?. Feel free to experiment with this.

Type the "exit" command until you are back in privileged mode. Your screen should look something like this:


Possibly the most important part of switching is saving your changes. To do this, use the following command. Do this every time you are done editing a Cisco device. If the device loses power, it will revert back to its last saved config.

trainswitch#write mem
Building configuration...

After this, you can reenter configuration mode.

Before you disconnect your console port, create a banner for your switch. This will appear anytime someone connects to it. Use the following command:

banner motd ^
Welcome to my switch!

You can put anything between the carrots. After you finish this, run the "write mem" command to save your work. Disconnect your console cable.

Once you ssh into the switch, print out (on the screen) the run config for your switch using the following:

trainswitch#show run

Setting up a Cisco Router

Now one of the useful qualities of Cisco devices is that the basic structure and feel of setting up different devices is very similar. For basic purposes, a Cisco Router and Switch will have many similar configuration commands. Make sure that are consoled in to the router and that you have followed the same setup instructions up to (but not including) step 1.2 for the router as you did for the switch in the Student Lab Setup. This will set up the basic configuration while leaving the ports untouched. You then need to do the same commands as above to set up SSH, a user account, AAA, and the console configuration. These commands do the same thing on both the switch and the router, so rather than directly influencing the network, they allow you better configure and manage these devices.

One of the important functionalities for a router is for it to have different ip addresses on each of its ports. This can be true on a switch as well, but it is especially important on a router. Because of this, we can set the ip address on the outward facing port (typically FastEthernet0/0) to be a static ip on a WAN, as well as a static ip on the internal LAN (typically on port FastEthernet0/1) such as so that devices connected on the switch can reach it.

Setting up an ip address on a port is relatively straightforward: just enter the interface configuration and run a command to specify the address and subnet mask. After doing so, it is important to make sure the interface is up by doing "no shutdown". Do the example shown below:

trainrtr(config)#int fa 0/0
trainrtr(config-if)# ip address
trainrtr(config-if)# no shutdown

This will set the ip address of the internal facing port, which should be connected to your switch already, to as well as specifying it is on a /24 subnet. This works well when there is only one internal network, but using vlans, we can have whole collection of internal networks, each on different subnets. Because of that, we will often want the router to be able to serve each of these different vlans, which we can use sub-interfaces to do. We will touch in more detail during the static routing lab how to set up a sub-interface, but using the entire physical interface works in this example.

SSH testing

At this point, both the switch and the router should have ports that are connected to the network. If these ports are connected together by an ethernet cable, they should be able to talk directly to each other. If they are not already connected, either attach a cable from the router's internal port to one of the switch's ports configured on vlan 70 (presumably ports 9-16), or connect the router's internal port to one of the switch's ports, then configure the port on the switch to access vlan 70.

By doing this, we make a connection where both the switch are attached to each other and are on the same network, therefor allowing them to communicate. We can test this by using the ssh command, which will allow you to access a console over the network. While connected to the router, use this command (make sure you are not in the configuration terminal):

trainrtr# ssh -l admin

If everything is working, it should ask you for the password for the switch, which once entered it will open up a console on the switch.


switchRearPorts.jpg (556 KB) switchRearPorts.jpg QA Test, 07/10/2018 10:40 AM
Rollovercable.jpg (2.77 MB) Rollovercable.jpg QA Test, 07/10/2018 10:49 AM