6

Since my computer has not serial port, the serial cable is of no help. Does the Catalyst 2940 acquire an address via DHCP? At least my DHCP server doesn't show any address which has been requested recently.

Maybe the Catalyst has to be reset first? I bought it second hand, so I don't know how it is configured right now.

I am a total newbie to Cisco products.

2
  • 1
    Since my computer has not serial port, the serial cable is of no help - Then it's time to get yourself a USB to Serial adapter. Here's just one of many available on the market today - amazon.com/TRENDnet-RS-232-Serial-Converter-TU-S9/dp/B0007T27H8
    – joeqwerty
    Jun 29, 2014 at 4:18
  • If the device supports IPv6, there exist a standardized method for finding its IPv6 address, which works on any brand of device. Just ping the IP address ff02::1, and you'll get an answer back from the IP address of the device. ff02::1 is link local scope, so you'll need to add scope ID, and how to do that depends on the OS on which you are running the ping command (on Linux you'd usually use ping6 ff02::1%eth0).
    – kasperd
    Jun 29, 2014 at 11:33

6 Answers 6

10

Word to the wise, don't connect a second hand switch to your production network before you wipe and/or re-configure it. Doing so can cause you MAJOR headaches if your network happens to use VTP. Without getting into the gritty details, connecting it could wipe or modify the VTP database used on your network (holding list of VLANs}, and basically cause your network to stop working.

And to answer your question, exactly as ewwhite said. You can get a usb-serial cable and console in that way. If you don't know the current password you can hold the mode button at boot to enter rommon mode and either wipe the config or change the password.

7

First you should probably know about tab completion and the '?' key for online help in IOS.

If I'd inherited a new Catalyst, I'd...

  1. Google "Password Recovery Catalyst 2900"

  2. Connect a Light-Blue Cisco console cable to it. You can make your own, but you'll still need a USB to serial adapter, they're $15 to $20 or so.

  3. Follow the instructions to reset the password. All of them.

  4. Login, and since I intend to reset it anyway, type this:

     en
     wr mem
     reload
    

    That is, enable (become a superuser), write (the configuration to) memory, and reload (reboot). "wr mem" is an old shortcut to the more formal "copy running-config startup-config." (If I was already logged in to a configured switch, I could use "write erase" but in this particular example, we've used Password Recovery to skip the startup-config anyway, so we're saving a blank config instead of erasing a valid config.)

  5. Then, to bring it online in a barebones fashion,

     en
     conf t
     service password-encryption
     enable secret cisco
     hostname myNewSwitch
     line vty 0 4
     pass cisco
     int vlan 1
     ip addr 172.31.1.1 255.255.255.0
     desc management interface
     no shut
     exit
     wr mem
     sh runn
    

    Here we enable, enter configuration mode from the terminal, enable simple password encryption, set the password for enable mode, give it a hostname, enter the remote VTY configuration (you may have more than five, beware), set the password for telnet/ssh, assign an IP address to the virtual interface for VLAN 1, give it a description, make sure it's not shut down, exit configuration mode, save the config, and then use "show running-config" to examine our changes. Now you can hopefully "telnet 172.31.1.1" if your machine is on that same subnet.

  6. You may want to add basic security to the interface; this access-control-list will only allow the local subnet to connect.

     access-list 100 remark vty
     access-list 100 permit tcp 172.31.1.0 0.0.0.255 host 0.0.0.0 range 22 telnet log-input
     access-list 100 deny ip any any log-input
     line vty 0 4
     access-class 100 in
    
  7. Everyone wants SNMP, let's add that quickly too. We'll pretend 172.31.1.161 is your Zabbix server and your community is statistics2:

     access-list 61 permit 172.31.1.161
     access-list 61 deny   any log
     snmp-server community statistics2 RO 61
    
  8. Actually, it's simple to add a username to the vty password, let's do that too

     aaa new-model
     username root privilege 15 password cisco
    
  9. Other useful commands:

      ip name-server 4.2.2.4
      ip domain-name example.com
      ip ssh version 2
      clock timezone UTC
      service timestamps log datetime
      spanning-tree mode pvst !or rpvst, or...
      spanning-tree uplinkfast
      spanning-tree backbone fast
      sh int vlan1
      sh ip int brief
    

And so that's a start, notably missing a default route/gateway. Please don't use "cisco" as your password, and please research VLANs. Others have made good suggestions, make use of their advice.

4

Connect to the switch using a Cisco console cable and the serial (or USB->serial converted) connection.

From there, you will need to configure its interfaces and local connection info. Being a used-device, you never know what configuration was left on the equipment. DHCP is most-certainly disabled by default.

2

You could also power the switch up - but as Cheekaleak said, not connected to your network. Use only a network cable between your PC and the switch. Try one of the "normalo" ports first. If you are familiar with linux, you could use cpdr (http://cdpr.sourceforge.net/, packages in major distros available). It shows you the management-ip as it is given in the cdp ethernet packet. This cdp packet could also be seen with wireshark.

1

In addition to the useful answers already given about USB/serial and not connecting unknown devices: by default a Cisco switch does not have an IP address configured and does not use DHCP to obtain one. It can do so, but it has to be configured first.

0

Does the Catalyst 2940 acquire an address via DHCP? At least my DHCP server doesn't show any address which has been requested recently.

This is possible, yes. However, per the answer by Teun Vink and others, by default a Cisco switch does not have an IP address configured (or may have an old/incorrect address). In order to assign a correct one, you may wish to check Chapter 4 of the Cisco Systems, Inc. Catalyst 2940 Switch Software Configuration Guide, 12.1(19)EA1. Here is an html version.

Per the manual:

You can assign IP information through the switch Express Setup program, through a Dynamic Host Configuration Protocol (DHCP) server, or manually by using the command-line interface (CLI). [...] Use the switch Express Setup program if you are a new user and want to provide specific IP information. With this program, you can also configure a default gateway and an enable secret password.

Furthermore:

Note: If you are using DHCP, do not respond to any of the questions in the setup program until the switch receives the dynamically-assigned IP address and reads the configuration file. [...] Use the manual method of configuration if you are an experienced user familiar with the switch configuration steps; otherwise, use the setup program described earlier.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .