# Administring a Cisco Switch - Basics for the Homelab Usage ## Connecting to the Switch Only quite old ssh parameters are supported: ``` ssh -oKexAlgorithms=+diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-rsa admin@192.168.2.1 ``` ## Saving the Configuration Never forget, otherwise after reboot changes are gone! ``` write memory ``` ## Configure VLANs Allow VLAN-IDs greater then 1005: ``` configure terminal vtp mode transparent exit ``` ``` configure terminal vlan 1001 name vlan1001 exit exit ``` The first `exit` leaves the VLAN, the second `exit` leaves the config session. If the VLAN should be used for management purposes additionally an interface for this VLAN is required with an IP address: ``` configure terminal vlan 2000 name vlan2000 exit interface vlan 2000 ip address dhcp exit exit ``` or ``` configure terminal vlan 2000 name vlan2000 exit interface vlan 2000 ip address 192.168.88.3 255.255.255.0 exit ip default-gateway 192.168.88.1 exit ``` Check your work: ``` show vlan ``` ## Configure Interfaces To check your work use ``` show interfaces status ``` ### Access Ports ``` configure terminal interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 1001 spanning-tree portfast no shutdown exit exit ``` ### Trunk Ports ``` configure terminal interface GigabitEthernet1/0/23 switchport mode trunk switchport trunk allowed vlan 1012,3001,3002,3003,3004 switchport trunk native vlan 1012 no shutdown exit exit ``` `allowed` connects the port to the VLAN for tagged communication. `native` makes the VLAN untagged on that port. ### SSH access and hardening measures First of all, the switch needs to know about time and requires a name: About time: ``` configure terminal ntp server de.pool.ntp.org clock timezone Etc/Utc exit ``` About names: ``` configure terminal hostname switch01 ip domain-name mynetwork.intern exit ``` An user is required: ``` configure terminal username admin password geheim123 exit ``` A host key must be generated: ``` crypto key generate rsa ``` This command will ask for the key length. Select 2048 bits. Set the SSH version: ``` ip ssh version 2 ``` Configure the virtual terminals accordingly: ``` configure terminal line vty 0 15 transport input ssh login local exit ``` As mentioned about, the switches support only quite old SSH protocols, so to access it use on the client side: ``` ssh -oKexAlgorithms=+diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-rsa admin@192.168.2.1 ```