Initial Configuration, Management Access, and Software Updates
Domain 2 - Initial Configuration, Management Access, and Software Updates. The exam checks that you can bring a factory-default switch into service safely: console access, accounts, in-band and out-of-band addressing, and the two-image/two-config model used for upgrades and rollback.
First boot and accounts
- Factory default: log in as
adminwith no password (newer releases force a password at first login). Immediately runconfigure account adminto set a strong password, and create per-person accounts withcreate account user <name>;show accountslists them. - Console defaults: 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. Keep console access as the recovery path when IP access breaks.
Management addressing
- Out-of-band: the dedicated management port is an untagged member of VLAN
mgmt. Address it withconfigure vlan mgmt ipaddress 10.0.0.10/24and add a default route withconfigure iproute add default 0.0.0.0/0 10.0.0.1. - In-band: create a management VLAN, add an untagged port, assign an IP, and enable forwarding with
enable ipforwarding vlan <vlan>. - Enable only the protocols you intend to allow:
enable ssh2anddisable telnet,enable snmpwith communities,enable web/enable https. Restrict who can reach them.
Image and configuration management
download image <tftp-ip> <file>.xos primary|secondarytransfers a new image into the chosen bank; it does not change what boots.use image secondarymarks the bank to boot;rebootapplies it.save configurationwrites the running config to NVRAM (primary by default);use configuration secondaryselects a config bank at next boot;show configurationprints the active running config.
Worked example
You must upgrade a switch reachable only by console. Step 1: save configuration so the current state survives. Step 2: download image 10.0.0.5 summitX-32.6.1.10.xos secondary, leaving the old image in primary. Step 3: use image secondary, then reboot. Step 4: after boot, show version should show secondary selected and booted; verify with show vlan, show iproute and show sharing. If anything fails, use image primary and reboot to roll back.
Traps that cost marks
- Rebooting or losing power before
save configuration- every CLI change is lost. - Downloading the new image over the bank that is currently booted, leaving no rollback path.
- Forgetting that SSH or HTTPS is disabled in some builds, or leaving Telnet enabled and failing a security question.
- Using the wrong file suffix or an image built for a different platform family.