CCNA online course

Configure a Switch Management IP Address

Learn how to configure a Cisco Layer 2 switch management IP address, SVI, management VLAN, default gateway, verification commands, and secure remote access.

What a Switch Management IP Address Does

A typical Layer 2 switch forwards Ethernet frames by examining destination MAC addresses. It does not need an IP address to perform ordinary Layer 2 switching between user devices.

An IP address is added so an administrator can reach the switch itself. Management protocols may include ping, SSH, Telnet where applicable, SNMP, HTTPS, and other supported services. This address is called the management IP address: an address used to administer and monitor the switch rather than to perform ordinary Layer 2 forwarding.

The management address is different from addresses assigned to end devices, such as computers and printers. It is also different from a routed interface on a multilayer switch or router. A Layer 2 switch normally has one management address associated with a VLAN, while a routed device may have multiple Layer 3 interfaces that forward traffic between networks.

Switch Virtual Interfaces and Management VLANs

An SVI, or Switched Virtual Interface, is a logical Layer 3 interface that represents a VLAN on a switch. Although it is configured with an interface command, it is not a physical connector.

A switch management address is commonly configured on an SVI. Physical access ports and trunk ports provide Layer 2 connectivity to the VLAN, while the SVI holds the switch's Layer 3 management address.

Many Cisco switches provide VLAN 1 as the default VLAN. VLAN 1 can be used for an initial lab, but a dedicated management VLAN is generally preferred in production. Separating management traffic makes the design easier to control with access lists, firewall policies, and restricted switchport assignments.

Choose an existing management VLAN or create a dedicated one. The VLAN, its SVI, and the switch ports carrying that VLAN must be connected. An SVI normally becomes operational only when the VLAN exists and at least one associated Layer 2 port has an active path. That path may be an access port connected to a device or an active trunk carrying the VLAN from another switch.

Addressing Plan

The management address must be unique in its subnet, use the correct subnet mask, and not be the network address or broadcast address. The default gateway must be the local router or multilayer-switch interface in the same management subnet.

Configure VLAN 1 for a Basic Lab

This example uses the default VLAN for a simple local lab. The switch receives 192.168.1.2/24, and the router interface at 192.168.1.1 is its default gateway.

enable
configure terminal
interface vlan 1
 ip address 192.168.1.2 255.255.255.0
 no shutdown
 exit
ip default-gateway 192.168.1.1
end
copy running-config startup-config

enable enters privileged EXEC mode. configure terminal enters global configuration mode. The interface vlan 1 command selects the SVI. The IP address and mask are configured under that interface, and no shutdown administratively enables it.

Configure a Dedicated Management VLAN

VLAN 99 is a common example of a dedicated management VLAN. The number is only an example; use the VLAN ID selected by your network design.

enable
configure terminal
vlan 99
 name MANAGEMENT
 exit
interface vlan 99
 ip address 192.168.99.2 255.255.255.0
 no shutdown
 exit
ip default-gateway 192.168.99.1
end

Creating the SVI alone does not provide a usable path. At least one active access port must belong to VLAN 99, or an active trunk must carry VLAN 99 to another switch or management device.

Assign an Access Port to the Management VLAN

An access port carries traffic for one VLAN. This example places GigabitEthernet1/0/1 in VLAN 99.

configure terminal
interface gigabitethernet1/0/1
 switchport mode access
 switchport access vlan 99
 no shutdown
end

A trunk port carries traffic for multiple VLANs, typically using VLAN tags. If management access comes through another switch, VLAN 99 must exist on the required switches and be allowed across every relevant trunk. A missing VLAN, a trunk that does not allow VLAN 99, a shutdown port, a disconnected cable, or a blocked Layer 2 path can prevent the SVI from becoming operational.

Configure the Default Gateway

A Layer 2 switch needs a default gateway when the management host is in another IP subnet. The switch can respond directly to hosts in its own subnet, but it sends off-subnet management traffic to the configured gateway so replies can reach remote networks.

configure terminal
ip default-gateway 192.168.99.1
end

The gateway must be the local router or multilayer-switch interface in the management subnet. On a Layer 2 switch, ip default-gateway supplies a management next hop; it does not enable the switch to route user traffic.

A multilayer switch is different. It can route between networks when Layer 3 routing is enabled, commonly with ip routing, routed interfaces, or Layer 3 SVIs. Do not confuse the Layer 2 switch default-gateway command with configuring a routing table on a multilayer switch.

Verify the Configuration

Use show commands before testing remote access. Confirm the address, interface state, VLAN membership, and gateway.

show ip interface brief
show interfaces vlan 99
show vlan brief
show running-config | include default-gateway
show running-config interface vlan 99
ping 192.168.99.1
show startup-config

show ip interface brief provides a quick view of the SVI address and state. show interfaces vlan 99 provides more detail about the SVI. show vlan brief confirms that the VLAN exists and shows access-port membership. The running configuration commands verify the gateway and SVI settings.

First ping the local gateway from the switch. Then ping the switch management address from a management workstation. For a remote-subnet test, place the workstation in a different IP network and verify that the switch has a correct default gateway and that the upstream device has a route back to the management subnet.

Save the Configuration

The running configuration is the active configuration held in memory. Changes take effect immediately but can be lost after a reload. The startup configuration is the saved configuration loaded when the switch starts.

copy running-config startup-config

Confirm the save when IOS prompts you. You can inspect the saved settings with show startup-config. Save after completing the SVI, VLAN, port, and gateway configuration.

Troubleshoot Management Reachability

SVI Is Administratively Down

The SVI is disabled. Check its state with show ip interface brief, enter the VLAN interface, and apply no shutdown.

configure terminal
interface vlan 99
 no shutdown
end

SVI Is Up Administratively but Line Protocol Is Down

The VLAN may not have an active Layer 2 member. Use show vlan brief to confirm that the VLAN exists and that an access port belongs to it. Check that a connected port is not shut down and that its cable and neighboring device are active. If the path crosses switches, verify that the VLAN is allowed on each required trunk.

Local Access Works but Remote Access Fails

Check the configured default gateway and ping it from the switch. If the gateway is correct, verify that the upstream router or multilayer switch has a route back to the management subnet. An incorrect mask can also make a host appear local or remote when it is not.

show running-config | include default-gateway
ping 192.168.99.1

Management PC Cannot Ping the Switch

Compare the workstation address, mask, and gateway with the SVI addressing plan. Then check the workstation's switchport VLAN, the SVI state, physical link status, VLAN existence, and possible duplicate IP address use.

Address Disappears After Reload

The active configuration was probably not saved. Copy the running configuration to the startup configuration and confirm that the SVI and gateway appear in show startup-config.

Remote-Management Security

Assigning an IP address makes the switch reachable at Layer 3, but it does not fully enable secure remote administration. SSH is the preferred remote CLI protocol because it encrypts management sessions. Telnet sends credentials and session data without adequate confidentiality and should generally be avoided.

A basic SSH follow-up may include a domain name, a local user, RSA keys, SSH version 2, and VTY lines that accept only SSH.

configure terminal
ip domain-name example.local
username admin privilege 15 secret <secure-password>
crypto key generate rsa
ip ssh version 2
line vty 0 4
 login local
 transport input ssh
end

Use a dedicated management VLAN and appropriate access controls where required. Restrict which hosts can reach management services, disable unused services, use strong credentials, and apply the organization's management-plane security policy.

Exam-Relevant Notes

• A Layer 2 switch forwards ordinary frames using MAC addresses and does not require an IP address for that forwarding.
• The management IP is commonly configured on an SVI, such as interface vlan 99, not on a physical access port.
• The SVI, VLAN, and Layer 2 path must all be operational before management reachability can work.
• Use ip default-gateway on a Layer 2 switch so it can reply to management traffic from another subnet.
• Use no shutdown to enable the SVI administratively.
• Always distinguish running-config from startup-config and save completed changes.
• An IP address alone does not secure remote management; prefer SSH and restrict access to the management plane.

For related IOS security fundamentals, see configure passwords in IOS. Routing concepts become especially important when management traffic crosses subnets; review OSPF configuration when studying dynamic routing.