Which Cisco switch commands should a CCNA beginner learn first?

Start with `enable`, `configure terminal`, `hostname`, `interface`, `show running-config` and `copy running-config startup-config`. Then practise VLAN, access port, trunk and verification commands.

How do I check VLANs configured on a Cisco switch?

Use `show vlan brief` to view VLAN IDs, names, status and assigned access ports. Use `show interfaces trunk` separately to check which VLANs are carried over trunk links.

What is the command to configure a Cisco switch port as a trunk?

Enter interface configuration mode and use `switchport mode trunk`. You can control permitted VLANs with `switchport trunk allowed vlan` and configure the native VLAN with `switchport trunk native vlan`.

What is the difference between running-config and startup-config?

The running configuration is the active configuration stored in RAM. The startup configuration is stored in NVRAM and is loaded during boot, so use `copy running-config startup-config` to save tested changes.

Which command shows the MAC addresses learned by a Cisco switch?

Use `show mac address-table` to display the switch's MAC address table. You can filter the output by interface, VLAN or dynamically learned entries.

Can I practise these Cisco switch commands in Packet Tracer?

Yes, Cisco Packet Tracer supports most commands required for common CCNA switching labs. Some platform-specific or advanced IOS features may be unavailable, so command behaviour should also be checked against the relevant Cisco documentation.

Top Cisco Switch Configuration Commands for CCNA

Cisco switch configuration is a core skill for every CCNA student. Whether you are practising in Cisco Packet Tracer, Cisco Modeling Labs, GNS3 or on a physical Catalyst switch, you must understand both configuration and verification commands.

Memorising commands alone is not enough. You should know which IOS mode a command belongs to, what it changes and how to confirm that the configuration is working. The commands below cover the switching tasks commonly encountered in CCNA labs and entry-level network support roles.

Understanding Cisco IOS Command Modes

Cisco IOS uses different command modes. The prompt tells you which mode is currently active.

Mode	Prompt example	Purpose
User EXEC	`Switch>`	Basic monitoring with limited access
Privileged EXEC	`Switch#`	Verification, debugging and configuration access
Global configuration	`Switch(config)#`	Device-wide configuration
Interface configuration	`Switch(config-if)#`	Physical or logical interface configuration
Line configuration	`Switch(config-line)#`	Console, VTY and auxiliary line settings
VLAN configuration	`Switch(config-vlan)#`	VLAN name and state configuration

Use enable to enter privileged EXEC mode and configure terminal to enter global configuration mode.

Switch> enable
Switch# configure terminal
Switch(config)#

The exit command moves back one level. The end command, or the Ctrl+Z shortcut, returns directly to privileged EXEC mode.

IOS supports abbreviated commands when the abbreviation is unique. For example, conf t may work instead of configure terminal. CCNA students should first learn the complete syntax because it makes configurations easier to read and reduces mistakes.

Basic Cisco Switch Configuration Commands

A new switch should receive a hostname, protected privileged access and appropriate login settings.

Configure the hostname

Switch(config)# hostname SW1
SW1(config)#

A useful hostname identifies the site, floor or device role. In a production network, names such as CHN-F1-ASW01 or BLR-CORE-SW01 are more meaningful than the default name.

Configure an enable secret

SW1(config)# enable secret StrongSecretPassword

The enable secret command protects privileged EXEC mode. It is preferred over the older enable password command because the secret is stored as a hash rather than in directly readable form.

Passwords shown here are examples only. Use passwords that follow the organisation's security policy.

Secure console access

SW1(config)# line console 0
SW1(config-line)# password ConsolePassword
SW1(config-line)# login
SW1(config-line)# logging synchronous
SW1(config-line)# exec-timeout 10 0

The login command tells IOS to request the configured line password. logging synchronous prevents system messages from disrupting command entry. exec-timeout 10 0 closes an inactive session after 10 minutes.

Configure an MOTD banner

SW1(config)# banner motd #Authorised access only#

The character after motd acts as the delimiter. The same character ends the message. A banner should communicate an access policy without revealing unnecessary information about the device or network.

Configuring Secure SSH Management

SSH encrypts management traffic and should be used instead of Telnet. The switch needs a hostname, domain name, local user, RSA keys and VTY configuration.

SW1(config)# ip domain-name example.local
SW1(config)# username admin privilege 15 secret AdminPassword
SW1(config)# crypto key generate rsa modulus 2048
SW1(config)# ip ssh version 2
SW1(config)# line vty 0 15
SW1(config-line)# login local
SW1(config-line)# transport input ssh
SW1(config-line)# exec-timeout 10 0

The number of VTY lines varies by platform and IOS release. Use line vty 0 4 if the device provides only five VTY lines.

A Layer 2 switch also requires a management IP address and default gateway for remote access from another subnet.

SW1(config)# interface vlan 10
SW1(config-if)# ip address 192.168.10.2 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# ip default-gateway 192.168.10.1

The VLAN must exist, and at least one associated switch port must be operational for the switched virtual interface, or SVI, to become fully up. The ip default-gateway command is used when the switch is operating as a Layer 2 device without IP routing enabled.

Essential Interface Configuration Commands

Enter an interface with the interface command. Interface names depend on the switch model and may include FastEthernet, GigabitEthernet or TenGigabitEthernet.

SW1(config)# interface gigabitEthernet 0/1
SW1(config-if)# description Connection-to-PC1
SW1(config-if)# no shutdown

Descriptions document what is connected to each port. This information is valuable during troubleshooting and planned changes.

Use shutdown to administratively disable a port:

SW1(config-if)# shutdown

Use an interface range when multiple ports require the same configuration:

SW1(config)# interface range gigabitEthernet 0/2 - 4
SW1(config-if-range)# description User-Access-Ports
SW1(config-if-range)# no shutdown

Range syntax can differ slightly between platforms, so check the context-sensitive help with interface range ? when necessary.

Creating and Assigning VLANs

VLANs create separate Layer 2 broadcast domains. A VLAN must be created before access ports are assigned to it.

Create a VLAN

SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name SUPPORT

VLAN names are optional but make the configuration easier to understand.

Configure an access port

SW1(config)# interface gigabitEthernet 0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10

switchport mode access forces the interface to operate as a Layer 2 access port. switchport access vlan 10 assigns untagged user traffic to VLAN 10.

Configure the mode explicitly rather than relying on dynamic negotiation. This produces predictable behaviour and is better for security.

Configure a voice VLAN

A port connected to a Cisco IP phone and a computer can use separate voice and data VLANs.

SW1(config)# interface gigabitEthernet 0/3
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# switchport voice vlan 30

The exact phone deployment may require additional quality of service and security settings. For CCNA practice, understand that data traffic uses the access VLAN while phone traffic uses the voice VLAN.

Configuring 802.1Q Trunk Ports

A trunk carries traffic for multiple VLANs between switches or between a switch and another network device.

SW1(config)# interface gigabitEthernet 0/1
SW1(config-if)# description Trunk-to-SW2
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,30,99

On switches that support more than one trunk encapsulation, you may need switchport trunk encapsulation dot1q before setting trunk mode. Many newer Cisco access switches support only IEEE 802.1Q and do not provide this command.

The native VLAN carries untagged frames by default. Both ends of a trunk should use the same native VLAN. A mismatch can produce warnings and create connectivity or security problems.

Modify the allowed list carefully:

SW1(config-if)# switchport trunk allowed vlan add 40
SW1(config-if)# switchport trunk allowed vlan remove 20

Entering switchport trunk allowed vlan 40 without add replaces the current allowed list with VLAN 40. This is a common CCNA lab mistake.

Spanning Tree Protocol Commands

Spanning Tree Protocol prevents Layer 2 loops by placing redundant paths into a blocking state. Rapid PVST+ provides a separate rapid spanning-tree instance for each VLAN.

SW1(config)# spanning-tree mode rapid-pvst

Configure the root bridge with a macro:

SW1(config)# spanning-tree vlan 10,20 root primary

Alternatively, configure an explicit bridge priority:

SW1(config)# spanning-tree vlan 10 priority 24576

Bridge priorities are configured in increments of 4096. The switch with the lowest bridge ID becomes the root bridge.

PortFast and BPDU Guard

PortFast allows an edge port to move quickly to the forwarding state. BPDU Guard protects that port if it unexpectedly receives a bridge protocol data unit.

SW1(config)# interface range gigabitEthernet 0/2 - 10
SW1(config-if-range)# spanning-tree portfast
SW1(config-if-range)# spanning-tree bpduguard enable

Use these commands only on ports connected to end devices. Do not enable PortFast on a normal switch-to-switch link, because it can increase the risk of a temporary switching loop.

Configuring EtherChannel with LACP

EtherChannel combines compatible physical links into one logical port-channel. It provides additional bandwidth and link redundancy while STP treats the bundle as one logical connection.

Configure LACP with active mode:

SW1(config)# interface range gigabitEthernet 0/23 - 24
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# exit
SW1(config)# interface port-channel 1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30,99

LACP modes are active and passive. At least one side must use active. Cisco's proprietary PAgP uses desirable and auto, while on creates a static EtherChannel without a negotiation protocol.

Member ports must have compatible speed, duplex and Layer 2 settings. Apply VLAN and trunk settings consistently, preferably on the port-channel interface according to the platform's configuration behaviour.

Switch Port Security Commands

Port security limits the MAC addresses permitted on an access port. It is normally configured on statically configured access ports rather than trunks.

SW1(config)# interface gigabitEthernet 0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict

Sticky learning adds dynamically learned secure MAC addresses to the running configuration. Save the configuration if those addresses must remain after a restart.

Common violation modes are:

protect: drops frames from unauthorised MAC addresses without generating a violation notification.
restrict: drops unauthorised traffic, increments the violation counter and generates notifications where supported.
shutdown: places the port into an error-disabled state and is the default violation mode.

Port security is useful for CCNA practice, but it is not a complete replacement for identity-based controls such as IEEE 802.1X.

Important Show and Troubleshooting Commands

Verification commands are as important as configuration commands. Most show commands run in privileged EXEC mode.

Check the current configuration

SW1# show running-config
SW1# show startup-config
SW1# show running-config interface gigabitEthernet 0/2

The running configuration is active in RAM. The startup configuration is loaded from NVRAM when the switch boots.

Verify interfaces and VLANs

SW1# show interfaces status
SW1# show interfaces gigabitEthernet 0/2
SW1# show interfaces gigabitEthernet 0/2 switchport
SW1# show vlan brief
SW1# show interfaces trunk

show interfaces status provides a quick view of port state, VLAN, duplex, speed and type. show interfaces switchport helps identify operational access and trunk settings.

Check MAC address learning

SW1# show mac address-table
SW1# show mac address-table dynamic
SW1# show mac address-table interface gigabitEthernet 0/2

A switch learns source MAC addresses and associates them with incoming ports. If a device cannot communicate, confirm that its MAC address appears on the expected interface and VLAN.

Verify STP, EtherChannel and port security

SW1# show spanning-tree
SW1# show spanning-tree vlan 10
SW1# show etherchannel summary
SW1# show port-security interface gigabitEthernet 0/2

In show etherchannel summary, flags help identify whether the port-channel and member links are correctly bundled. For STP, check the root bridge, root port, port role and port state.

Test IP connectivity

SW1# show ip interface brief
SW1# ping 192.168.10.1
SW1# show arp

show ip interface brief displays IP addresses and interface states. A successful ping confirms Layer 3 reachability, but it does not prove that every application or network path is working.

Saving and Removing Configuration

Save the active configuration after testing it:

SW1# copy running-config startup-config

The commonly used write memory command also saves the configuration on many IOS platforms, but copy running-config startup-config clearly describes the operation and is preferred for learning.

Remove a command by placing no before it:

SW1(config)# no ip default-gateway 192.168.10.1
SW1(config-if)# no shutdown

Notice that no shutdown removes the administratively shut state; it enables the interface.

To erase a lab switch completely, you may need to remove both the startup configuration and the VLAN database:

SW1# erase startup-config
SW1# delete flash:vlan.dat
SW1# reload

File locations vary by platform. Use these commands only on authorised lab equipment, never on a production switch without an approved change and recovery plan.

A Practical CCNA Configuration Workflow

Use a structured method during Packet Tracer exercises and physical lab sessions:

Draw the topology and record interface numbers, VLAN IDs and IP addresses.
Configure hostnames and secure management access.
Create the required VLANs.
Configure access ports and trunk links.
Add STP, EtherChannel and port security settings where required.
Verify each layer with show commands before testing end-to-end connectivity.
Save the configuration only after checking the result.

In Chennai and Bangalore networking interviews, candidates may be asked to interpret command output rather than simply type a memorised configuration. Practise identifying VLAN mismatches, disabled interfaces, incorrect trunk allowed lists, STP blocking states and EtherChannel inconsistencies.

The most effective CCNA preparation combines command practice with troubleshooting. Build small topologies, introduce one fault at a time and use IOS output to locate the problem. This approach develops the practical switching skills required for Cisco labs and entry-level network engineering roles.

Top Cisco Switch Configuration Commands for CCNA Students