Cisco IOS // Reset & Initial Setup

Hard reset

connect to its serial console and power up the switch

screen /dev/ttyS0
screen /dev/ttyS0 9600

either proceed with a hard reset (while it is powered on)

hold mode button 3-7 seconds

and skip the wizard

Would you like to enter the initial configuration dialog? [yes/no]: n

Soft reset

–or– start from scratch (erasing both running and startup configs)

enable
write erase
!erase startup-config
reload
System configuration has been modified. Save? [yes/no]: n

and skip the wizard

Would you like to enter the initial configuration dialog? [yes/no]:

Initial setup

now is a good time for firmware upgrade

enter power execution mode and let’s keep global mode

enable
!setup
configure terminal

define a hostname and bring the interfaces up on Vlan1 and disable the freaking http server

hostname SWITCH-NAME

interface vlan1
no shutdown
ip address 10.7.7.203 255.255.255.0
ip route-cache
no ip http server
exit

!no ip address
!shutdown

in case you really wanna try it out, reach port 80 and enter password w/o username

the management ip can also be set on an alternate VLAN – but only one Switch Virtual Interface at a time – at least for those old layer 2 switches like the 2950

Defining passwords

passwords are optional for serial console access

but you have to define some for both remote telnet access and enable

Password required, but none set

% No password set

create a local database (allows MD5)

configure terminal
username admin secret ?
username admin secret PASSWORD

therefore

configure terminal
enable secret ?
enable secret PASSWORD

define a password for serial console

line console 0
exec-timeout 0 0
logging synchronous
login local
exit

no MD5 w/o local database

!line console 0
!exec-timeout 0 0
!password PASSWORD
!logging synchronous
!login
!exit

and auth method for remote access

line vty 0 4
exec-timeout 0 0
logging synchronous
login local
exit

line vty 5 15
exec-timeout 0 0
logging synchronous
login local
exit

no MD5 w/o local database

!line vty 0 4
!exec-timeout 0 0
!password PASSWORD
!logging synchronous
!login
!exit

!line vty 5 15
!exec-timeout 0 0
!password PASSWORD
!logging synchronous
!login
!exit

Enabling SSH

provide at least 1024 unless you want to deal with ssh’s Invalid key length

!do show memory
!do show process
ip domain-name localdomain !be it domain.tld or whatever
crypto key generate rsa usage-keys
(Signature) How many bits in the modulus [512]: 1024
(Encryption) How many bits in the modulus [512]: 1024
!do show memory
!do show process

disable telnet / switch to SSH

line vty 0 4
transport input ssh
exit

line vty 5 15
transport input ssh
exit

usage

ssh 10.7.7.203 -p 22 -l admin -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=+3des-cbc
ssh 10.7.7.204 -p 22 -l admin -oKexAlgorithms=+diffie-hellman-group1-sha1 -oCiphers=+3des-cbc

vi ~/.ssh/config

Host loud1
        Hostname 10.7.7.203
        User admin
        Port 22
        KexAlgorithms +diffie-hellman-group1-sha1
        Ciphers +3des-cbc

Host loud2
        Hostname 10.7.7.204
        User admin
        Port 22
        KexAlgorithms +diffie-hellman-group1-sha1
        Ciphers +3des-cbc