Cisco IOS Configuration for Switches and Routers Turnkey

Cisco IOS Configuration for Switches and Routers Turnkey

We configure Cisco IOS for corporate networks turnkey: from simple VLANs to full OSPF with gateway redundancy. With over 10 years of experience, we have encountered dozens of situations where incorrect STP or VTP configuration brought down entire offices. Below are typical issues and our approach to solving them.

Recently we dealt with an incident: a broadcast storm due to missing BPDU Guard on access switches paralyzed an office for 3 hours. Someone connected an unauthorized switch to a port, creating a loop. After that, we implemented Rapid PVST+ with PortFast and BPDU Guard on all access ports. The issue was resolved, the network became stable. Contact us for an audit — we will check vulnerabilities in two days.

How to configure STP without the risk of a broadcast storm?

Spanning Tree Protocol is the source of half of the incidents in switched networks. Incorrectly configured STP or its absence leads to a broadcast storm that brings down the network in seconds. We use Rapid PVST+ as the standard.

Basic best practices for access-layer switches:

! Enable Rapid PVST+ (faster than STP, based on 802.1w)
spanning-tree mode rapid-pvst
!
! Root bridge should be distribution/core switch
spanning-tree vlan 1-4094 priority 4096
! on core switch
spanning-tree vlan 1-4094 priority 8192
! on distribution (backup)
!
! PortFast on end device ports (not trunk!)
interface range GigabitEthernet1/0/1-24
 spanning-tree portfast
 spanning-tree bpduguard enable
! bpduguard puts port into err-disabled if BPDU received
! — protects against unauthorized switch connection

bpduguard + portfast is a mandatory pair. PortFast without bpduguard creates a possibility for a loop if someone connects a switch to the port.

For trunk ports and uplink ports — spanning-tree guard root protects against attacks that change the root bridge:

interface GigabitEthernet1/0/48
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,100
 spanning-tree guard root

Why is it better to disable VTP in production?

VTP is convenient, but in production it becomes a risk. VTP revision number: if a used switch with a high revision number is connected to the network, it overwrites the VLAN database on all VTP clients. This erases the VLAN configuration of the entire network. Real incidents with this scenario are documented.

! Disable VTP on all switches
vtp mode transparent
! or vtp mode off
! IOS-XE 15.2+
! Create VLANs manually on each switch
vlan 10
 name Users
vlan 20
 name Servers
vlan 30
 name Management
vlan 100
 name Native-Trunk

The native VLAN on trunk ports should be an unused VLAN (not VLAN 1). VLAN 1 is the default for STP BPDU and CDP/LLDP, and if the native VLAN matches a user VLAN, VLAN hopping is possible.

Choosing between Router-on-a-Stick and L3 Switch

Two approaches to inter-VLAN routing. Router-on-a-Stick uses subinterfaces on a router, logical when a separate router is present. L3 Switch with SVI is more performant because switching happens in hardware.

! L3 Switch: SVI configuration
ip routing
!
! enable routing
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip helper-address 192.168.30.5
 ! DHCP relay
 no shutdown
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 no shutdown
!
! ACL between VLANs
ip access-list extended VLAN20-to-VLAN10
 permit tcp 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255 eq 5432
 deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
 permit ip any any
interface Vlan20
 ip access-group VLAN20-to-VLAN10 in

For gateway redundancy, we configure HSRP or VRRP — without it, if the primary L3 switch fails, the entire segment loses routing.

interface Vlan10 standby 1 ip 192.168.10.1 standby 1 priority 110 standby 1 preempt no shutdown 

How to configure OSPF for a multi-site network?

For dynamic routing between multiple offices, we use OSPF area 0 for the backbone and child areas for remote sites. Step-by-step instruction:

1. Manually assign router-id on each router.
2. Set passive-interface default to avoid advertising OSPF on client ports.
3. Configure non-backbone areas as stub or NSSA to reduce routing tables.
4. Enable message-digest authentication on all OSPF interfaces.

Example configuration:

router ospf 1
 router-id 10.0.0.1
 passive-interface default
 no passive-interface GigabitEthernet0/1
 network 192.168.10.0 0.0.0.255 area 0
 network 10.0.0.0 0.0.0.255 area 0
 area 10 stub
interface GigabitEthernet0/1
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 <password>

Monitoring via SNMP and NetFlow

snmp-server group MONITORING v3 priv
snmp-server user prometheus MONITORING v3 auth sha AuthPass priv aes 128 PrivPass
ip flow-export version 9
ip flow-export destination 192.168.30.10 9995
interface GigabitEthernet0/0
 ip flow ingress
 ip flow egress

We direct NetFlow data to ntopng, pmacct, or Elastic Stack to build a traffic baseline and detect anomalies.

What is included in the work

• Audit of current configuration and topology
• Design (VLAN, STP, routing, ACL, QoS)
• Equipment configuration (switches, routers)
• Failover testing (HSRP, port-security)
• Documentation (network diagram, ACL description, monitoring parameters)
• Staff training on basic operation
• 30 days of post-handover support

Get an expert consultation on Cisco IOS configuration — our engineers with CCNP certification and 5+ years of experience are ready to take on projects of any complexity.

Common configuration mistakes

Saving configuration is a classic loss. copy running-config startup-config or write memory — mandatory after every change. Without saving, everything is lost after a reboot.

Duplicate IP addresses on interfaces of two devices in the same segment cause intermittent packet loss, which is extremely hard to diagnose without packet capture. show ip arp + debug arp helps identify the conflict.