the clean baseline config every switch needs first

why bother with a baseline

every switch you rack should start from the same clean config before it does anything fancy with vlans, security, or fancy routing tricks. this isn't about looking pro on a ccna exam, it's about not getting burned six months from now when you're trying to remember which switch is which at 2am during an outage. a consistent baseline means every device behaves the same way, fails the same way, and gets fixed the same way.

hostname, because "switch" is not a name

the default hostname on a cisco switch is just "switch" and if you have more than one of those on your network you're already in trouble. set a real hostname immediately.

hostname SW1-CLOSET-A

this seems trivial until you're staring at a terminal session during an incident and you genuinely don't know which physical box you're logged into. name it after location or function, not "switch1" or your dog's name.

turn off domain lookup before it eats your session

by default, cisco ios tries to resolve anything you type wrong as a dns name. so if you fat finger a command, the switch pauses for a good while trying to look it up instead of just telling you "invalid input." that delay is annoying during normal work and genuinely dangerous during an outage when seconds matter.

no ip domain-lookup

one line, huge quality of life improvement, and it removes an accidental attack surface where a typo could send a dns query out to who knows where.

lock the doors: enable secret and console password

a switch with no password is a switch anyone with physical or console access can reconfigure, reroute, or straight up brick. set an enable secret, which is hashed, instead of the plaintext enable password.

enable secret YourStrongPasswordHere
line console 0
 password YourConsolePassword
 login

defensively speaking, this is your first line of protection against someone plugging a console cable into an unattended device in a closet. pair it with physical security for your equipment, because a password doesn't matter if the closet door is propped open.

one vlan, assigned ports, and a trunk that isn't a free-for-all

start with a single, deliberately created vlan instead of leaving everything on the default vlan 1. default vlan 1 is what attackers expect and what most vlan-hopping techniques target first, so moving your real traffic off it is a simple defensive win.

vlan 10
 name USERS

interface range fa0/1 - 20
 switchport mode access
 switchport access vlan 10

interface gi0/1
 switchport mode trunk
 switchport trunk allowed vlan 10

notice the trunk explicitly allows only vlan 10, not "all vlans by default." that's the defensive habit worth building: don't let a trunk carry traffic it doesn't need to carry. fewer vlans on a trunk means a smaller blast radius if something on the network gets compromised.

write memory, or lose everything

none of this matters if a power blip wipes your running config. save it.

write memory

or the older but still valid copy running-config startup-config. either way, get in the habit of saving after every deliberate change. an unsaved config is a config that doesn't exist the moment the device reboots, and "i configured it correctly but forgot to save" is not a sentence you want to say during a postmortem.

the takeaway

a clean baseline isn't glamorous but it's the difference between a network you understand and a network that's just accumulating random changes from whoever touched it last. hostname so you know what you're looking at, no domain lookup so typos don't hang you, real passwords so random people can't waltz into privileged mode, deliberate vlans and trunk restrictions so traffic goes where it's supposed to, and always save your work. get this part right on every switch you own and half your future troubleshooting and security headaches disappear before they start. everything after this is policy, asa lists, port security, whatever you need, but it's all built on top of a foundation that actually holds weight.