What Is a Network Switch? Types and Basic Cisco Switch Configuration

A network switch connects devices on a local network and forwards traffic only where it needs to go. It is the backbone of almost every office and data centre network. This guide explains how switches work, the main types and a basic, secure network switch configuration on a Cisco switch.

How a switch works

A switch works mainly at layer 2 of the OSI model. It learns which device sits on which port by reading the source MAC address of every frame and storing it in a MAC address table. When a frame arrives, the switch looks up the destination MAC address:

• if it knows the port, it sends the frame only there;
• if it does not, it floods the frame to all ports in the same VLAN;
• broadcasts always go to every port in the VLAN.

As a result, each port is its own collision domain, and devices can send and receive at full speed at the same time (full duplex).

Types of switches

Basic Cisco switch configuration

The steps below prepare a new switch with secure management. Replace names and addresses with your own.

1. Set the host name and secure privileged mode

Switch> enable
Switch# configure terminal
Switch(config)# hostname SW-ACCESS-01
SW-ACCESS-01(config)# enable algorithm-type scrypt secret Str0ng-Enable-Pass
SW-ACCESS-01(config)# service password-encryption
SW-ACCESS-01(config)# no ip domain-lookup

2. Configure a management VLAN and IP address

SW-ACCESS-01(config)# vlan 99
SW-ACCESS-01(config-vlan)# name MGMT
SW-ACCESS-01(config-vlan)# exit
SW-ACCESS-01(config)# interface vlan 99
SW-ACCESS-01(config-if)# ip address 10.0.99.11 255.255.255.0
SW-ACCESS-01(config-if)# no shutdown
SW-ACCESS-01(config-if)# exit
SW-ACCESS-01(config)# ip default-gateway 10.0.99.1

3. Enable SSH and disable Telnet

SW-ACCESS-01(config)# ip domain-name example.local
SW-ACCESS-01(config)# crypto key generate rsa modulus 3072
SW-ACCESS-01(config)# ip ssh version 2
SW-ACCESS-01(config)# username admin privilege 15 algorithm-type scrypt secret Str0ng-Admin-Pass
SW-ACCESS-01(config)# line vty 0 15
SW-ACCESS-01(config-line)# login local
SW-ACCESS-01(config-line)# transport input ssh
SW-ACCESS-01(config-line)# exit

4. Configure access and trunk ports

SW-ACCESS-01(config)# interface range GigabitEthernet1/0/1 - 24
SW-ACCESS-01(config-if-range)# switchport mode access
SW-ACCESS-01(config-if-range)# switchport access vlan 10
SW-ACCESS-01(config-if-range)# spanning-tree portfast
SW-ACCESS-01(config-if-range)# spanning-tree bpduguard enable
SW-ACCESS-01(config-if-range)# exit
SW-ACCESS-01(config)# interface GigabitEthernet1/0/48
SW-ACCESS-01(config-if)# switchport mode trunk
SW-ACCESS-01(config-if)# switchport trunk allowed vlan 10,20,99

For VLAN details, see VLAN configuration on Cisco.

5. Add a banner and save

SW-ACCESS-01(config)# banner login ^Authorised access only.^
SW-ACCESS-01(config)# end
SW-ACCESS-01# copy running-config startup-config

Useful verification commands

Security best practices

• Shut down unused ports and move them to an unused VLAN.
• Enable port security, DHCP snooping and Dynamic ARP Inspection on access ports.
• Use AAA with TACACS+ or RADIUS for admin logins. See AAA in networking.
• Keep firmware updated.
• Send logs to a central syslog server and synchronise time with NTP.

Sources

• Cisco: Network fundamentals and configuration guides

Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.