Configure Password Settings on a Switch through the Command Line Interface (CLI) (2024)

Objective

The first time that you log in to your switch through the console, you have to use the default username and password, which is cisco. You are then prompted to enter and configure a new password for the Cisco account. Password complexity is enabled by default. If the password that you choose is not complex enough, you are prompted to create another password.

Since passwords are used to authenticate users accessing the device, simple passwords are potential security hazards. Therefore, password complexity requirements are enforced by default and may be configured as necessary.

This article provides instructions on how to define basic password settings, line password, enable password, service password recovery, password complexity rules on the user accounts, and password aging settings on your switch through the Command Line Interface (CLI).

Note: You have the option to configure the password strength and complexity settings through the web-based utility of the switch as well. click here for instructions.

Applicable Devices | Software Version

Sx300 Series | 1.4.7.06 (Download latest)
Sx350 Series | 2.2.8.04 (Download latest)
SG350X Series | 2.2.8.04 (Download latest)
Sx500 Series | 1.4.7.06 (Download latest)
Sx550X Series | 2.2.8.04 (Download latest)

Configure Password Settings through the CLI

From the options below, choose the password settings that you want to configure:

Configure Basic Password Settings

Configure Line Password Settings

Configure Enable Password Settings

Configure Service Password Recovery Settings

Configure Password Complexity Settings

Configure Password Aging Settings

Configure Basic Password Settings

Step 1. Log in to the switch console. The default username and password is cisco.

Note: The available commands or options may vary depending on the exact model of your device. In this example, the SG350X switch is used.

Step 2. You will be prompted to configure new password for better protection of your network. Press Y for Yes or N for No on your keyboard.

Note: In this example, Y is pressed.

Step 3. Enter the old password then press Enter on your keyboard.

Step 4. Enter and confirm the new password accordingly then press Enter on your keyboard.

Step 5. Enter Privileged EXEC mode with the enable command. In the Privileged EXEC mode of the switch, save the configured settings to the startup configuration file, by entering the following:

SG350X#copy running-config startup-config

Step 6. (Optional) Press Y for Yes or N for No on your keyboard once the Overwrite file [startup-config]… prompt appears.

You should now have configured the basic password settings on your switch through the CLI.

Configure Line Password Settings

Step 1. Log in to the switch console. The default username and password is cisco. If you have configured a new username or password, enter those credentials instead.

Step 2. In the Privileged EXEC mode of the switch, enter the Global Configuration mode by entering the following:

SG350X#configure terminal

Step 3. To configure a password on a line such as console, Telnet, Secure Shell (SSH), and so on, enter the password Line Configuration mode by entering the following:

SG350X(config)#line [line-name]

Note: In this example, the line used is Telnet.

Step 4. Enter the password command for the line by entering the following:

SG350X(config-line)#password [password][encrypted]

The options are:

Configure Enable Password Settings

When you configure a new enable password, it is automatically encrypted and saved to the running configuration file. No matter how the password was entered, it will appear in the running configuration file with the keyword encrypted together with the encrypted password.

Follow these steps to configure the enable password settings on your switch through the CLI:

Step 1. Log in to the switch console. The default username and password is cisco. If you have configured a new username or password, enter those credentials instead.

Step 2. In the Privileged EXEC mode of the switch, enter the Global Configuration mode by entering the following:

SG350X#configure terminal

Step 3. To configure a local password on specific user access levels on your switch, enter the following:

SG350X(config)#enable password [level privilege-level] [unencrypted-password | encrypted encrypted-password]

The options are:

level privilege-level — Specifies the level for which the password applies. The level ranges from 1 to 15. If not specified, the level is set to the default value of 15. The user levels are as follows:

- Read-Only CLI Access (1) — User cannot access the GUI, and can only access CLI commands that do not change the device configuration.

- Read/Limited Write CLI Access (7) — User cannot access the GUI, and can only access some CLI commands that change the device configuration. See the CLI Reference Guide for more information.

- Read/Write Management Access (15) — User can access the GUI, and can configure the device.

SG350X(config)#enable password level 7 Cisco123$

Note:In this example, the password Cisco123$ is set for the level 7 user account.

unencrypted-password — The password for the username that you are currently using. The length ranges from 0 to 159 characters.

SG350X(config)#enable password level Cisco123$

Note:In this example, the password Cisco123$ is used.

encrypted encrypted-password — Specifies that the password is encrypted. You can use this command to enter a password that is already encrypted from another configuration file of another device. This will allow you to configure the two switches with the same password.

SG350X(config)#enable password encrypted 6f43205030a2f3a1e243873007370fab

Note: In this example, the encrypted password used is 6f43205030a2f3a1e243873007370fab. This is the encrypted version of Cisco123$.

Note: In the above example, the enable password Cisco123$ is set for the level 7 access.

Step 4. (Optional) To return the user password to the default password, enter the following:

SG350X(config)#no enable password

Step 5. Enter the exit command to go back to the Privileged EXEC mode of the switch.

SG350X(config)#exit

Step 6. (Optional) In the Privileged EXEC mode of the switch, save the configured settings to the startup configuration file, by entering the following:

SG350X#copy running-config startup-config

Step 7. (Optional) Press Y for Yes or N for No on your keyboard once the Overwrite file [startup-config]… prompt appears.

You should now have configured the enable password settings on your switch through the CLI.

Configure Service Password Recovery Settings

The service password recovery mechanism provides you with physical access to the console port of the device with the following conditions:

If password recovery is enabled, you can access the boot menu and trigger the password recovery in the boot menu. All configuration files and user files are kept.
If password recovery is disabled, you can access the boot menu and trigger the password recovery in the boot menu. The configuration files and user files are removed.
If a device is configured to protect its sensitive data with a user-defined passphrase for Secure Sensitive Data, then you cannot trigger the password recovery from the boot menu even if password recovery is enabled.

Service password recovery is enabled by default. Follow these steps to configure the service password recovery settings on your switch through the CLI:

Step 1. Log in to the switch console. The default username and password is cisco. If you have configured a new username or password, enter those credentials instead.

Step 2. In the Privileged EXEC mode of the switch, enter the Global Configuration mode by entering the following:

SG350X#configure terminal

Step 3. (Optional) To enable the password recovery setting on the switch, enter the following:

SG350X#service password-recovery

Step 4. (Optional) To disable the password recovery setting on the switch, enter the following:

SG350X#no service password-recovery

Step 5. (Optional) Press Y for Yes or N for No on your keyboard once prompt below appears.

Note: In this example, Y is pressed.

Step 6. Enter the exit command to go back to the Privileged EXEC mode of the switch.

SG350X(config)#exit

Step 7. (Optional) In the Privileged EXEC mode of the switch, save the configured settings to the startup configuration file, by entering the following:

SG350X#copy running-config startup-config

Step 8. (Optional) Press Y for Yes or N for No on your keyboard once the Overwrite file [startup-config]… prompt appears.

You should now have configured the password recovery settings on your switch through the CLI.

Configure Password Complexity Settings

The password complexity settings of the switch enable complexity rules for passwords. If this feature is enabled, new passwords must conform to the following default settings:

Have a minimum length of eight characters.
Contain characters from at least four character classes such as uppercase letters, lowercase letters, numbers, and special characters available on a standard keyboard.
Are different from the current password.
Contain no character that is repeated more than three times consecutively.
Do not repeat or reverse the users name or any variant reached by changing the case of the characters.
Do not repeat or reverse the manufacturers name or any variant reached by changing the case of the characters.

You can control the above attributes of password complexity with specific commands. If you have previously configured other complexity settings, then those settings are used.

This feature is enabled by default. Follow these steps to configure the password complexity settings on your switch through the CLI:

Step 1. Log in to the switch console. The default username and password is cisco. If you have configured a new username or password, enter those credentials instead.

Step 2. In the Privileged EXEC mode of the switch, enter the Global Configuration mode by entering the following:

SG350X#configure terminal

Step 3. (Optional) To enable the password complexity settings on the switch, enter the following:

SG350X(config)#passwords complexity enable

Step 4. (Optional) To disable the password complexity settings on the switch, enter the following:

SG350X(config)#no passwords complexity enable

Step 5. (Optional) To configure the minimum requirements for a password, enter the following:

SG350X(config)#passwords complexity [min-length number] [min-classes number] [not-current] [no-repeat number] [not-username] [not manufacturer-name]

The options are:

min-length number — Sets the minimal length of the password. The range is from 0 to 64 characters. The default value is 8.
min-classes number — Sets the minimal character classes such as uppercase letters, lowercase letters, numbers, and special characters available on a standard keyboard. The range is from 0 to 4 classes. The default value is 3.
not-current — Specifies that the new password cannot be the same as the current password.
no-repeat number — Specifies the maximum number of characters in the new password that can be repeated consecutively. Zero specifies that there is no limit on repeated characters. The range is from 0 to 16 characters. The default value is 3.
not-username — Specifies that the password cannot repeat or reverse the user name or any variant reached by changing the case of the characters.
not-manufacturer-name — Specifies that the password cannot repeat or reverse the name of the manufacturer or any variant reached by changing the case of the characters.

Note: These commands do not wipe out the other settings. Configuring the passwords complexity settings only work as a toggle.

Note: In this example, the password complexity is set to at least 9 characters, cannot repeat or reverse the user name, and cannot be the same as the current password.

Step 6. Enter the exit command to go back to the Privileged EXEC mode of the switch.

SG350X(config)#exit

Step 7. (Optional) In the Privileged EXEC mode of the switch, save the configured settings to the startup configuration file, by entering the following:

SG350X#copy running-config startup-config

Step 8. (Optional) Press Y for Yes or N for No on your keyboard once the Overwrite file [startup-config]… prompt appears.

You should now have configured the password complexity settings on your switch through the CLI.

To show the password configuration settings on the CLI of your switch, skip to Show Passwords Configuration Settings.

Configure Password Aging Settings

Aging is relevant only to users of the local database with privilege level 15 and to configured enable passwords of privilege level 15. The default configuration is 180 days.

Follow these steps to configure the password aging settings on your switch through the CLI:

Step 1. Log in to the switch console. The default username and password is cisco. If you have configured a new username or password, enter those credentials instead.

Step 2. In the Privileged EXEC mode of the switch, enter the Global Configuration mode by entering the following:

SG350X#configure terminal

Step 3. To specify the password aging setting on the switch, enter the following:

SG350X(config)#passwords aging [days]

days — Specifies the number of days before a password change is forced. You can use 0 to disable aging. The range is from 0 to 365 days.

Note: In this example, the password aging is set to 60 days.

Step 4. (Optional) To disable password aging on the switch, enter the following:

SG350X(config)#no passwords aging 0

Step 5. (Optional) To return the password aging to the default setting, enter the following:

SG350X(config)#no passwords aging [days]

Step 6. Enter the exit command to go back to the Privileged EXEC mode of the switch.

SG350X(config)#exit

Step 7. (Optional) In the Privileged EXEC mode of the switch, save the configured settings to the startup configuration file, by entering the following:

SG350X#copy running-config startup-config

Step 8. (Optional) Press Y for Yes or N for No on your keyboard once the Overwrite file [startup-config]… prompt appears.

You should now have configured the password aging settings on your switch through the CLI.

To show the password configuration settings on the CLI of your switch, skip to Show Passwords Configuration Settings.

Show Passwords Configuration Settings

Aging is relevant only to users of the local database with privilege level 15 and to configured enable passwords of privilege level 15. The default configuration is 180 days.

Step 1. In the Privileged EXEC mode of the switch, enter the following:

SG350X(config)#show passwords configuration

Configure Password Settings on a Switch through the Command Line Interface (CLI) (2024)

FAQs

How to configure a switch in CLI? ›

Steps to configure Cisco switch using CLI

Initial command prompt "Switch>" appears on the screen.
Type "enable" next to it and press "Enter".
This will take you into the "EXEC" mode, also known as the Global Configuration mode.
Go into configure mode using configure terminal.

More items...

Read On ›

What command is used for setting all password as encrypted in switch? ›

With enable secret command, password is encrypted but is visible on the terminal when you type the password. To mask the password on the terminal, use the masked-secret global configuration command. The encryption type for this password is type 9, by default.

Discover More Details ›

How many line Vty interfaces can you configure passwords on switches? ›

Note the example below where I set the password to auxpassword. The virtual terminal or “VTY” lines are virtual lines that allow connecting to the device using telnet or Secure Shell (SSH). Cisco devices can have up to 16 VTY lines.

What is CLI on a switch? ›

What Is CLI (Command Line Interface)? CLI stands for Command Line Interface, which allows users to write commands in a terminal or console window to communicate with an operating system. CLI acts as the medium between operators and the network switch: Users have to type command to perform a task.

See Details ›

What is CLI configuration? ›

Most Cisco devices (including routers and switches) use a CLI (Command Line Interface) to configure the network device. The CLI is an interface, based on text. You type in configuration commands and use show commands to get the output from the router or switch.

Find Out More ›

Which command is used to set password? ›

The passwd command sets and changes passwords for users.

Tell Me More ›

What is the command to set an encrypted password? ›

Explanation. The _enable secret [password] command enables an encrypted password and overrides the enable password if it is set.

Show Me More ›

How to configure Cisco switch with console cable? ›

Plug the serial DB9 end of the console cable into your computer's serial port and connect the RJ45 end on the Cisco Switch. But if your computer does not have a serial DB-9 port, connect the serial DB9 console cable end into the Serial-to-USB adapter and then plug it into your laptop.

Explore More ›

Which command will configure a switch port to use the? ›

Correct answer is option 'E'. Can you explain this answer? Which command will configure a switch port to use the IEEE standard me... If you are on a 2950 switch, then the interface command is just switchport mode trunk, since the 2950 can only run the IEEE 802.1Q version.

What is the minimum password length in cisco CLI? ›

Password Length Policy

The recommended minimum password length is 8 characters. The administrator can specify both the minimum (1) and the maximum (64) length for the password.

Show Me More ›

What is the minimum password length Cisco switch command? ›

CISC-ND-000550 - The Cisco switch must be configured to enforce a minimum 15-character password length.

Read The Full Story ›

How many subinterfaces can be configured on an interface cisco? ›

You can partition one physical interface into up to 4094 different subinterfaces, one for each VLAN.

See Details ›

How to access CLI command-line? ›

Use the correct method for your computer's operating system to open the CLI: Microsoft Windows® — Open the Command Prompt program. To do this, click Start and enter Command Prompt in the Search text box. Double-click Command Prompt in the list that appears.

Get More Info Here ›

How is CLI used in switch installation? ›

Use the switch CLI to configure switches, to query the state of switches, and to access the embedded Subnet Manager. After the configuration setup has been completed, the CLI chassis viewer is used as part of diagnostic testing after the fabric viewer or fast fabric tools have been used.

What is an example of a CLI? ›

The MS-DOS operating system and the command shell in the Windows operating system are examples of command-line interfaces. In addition, programming language development platforms such as Python can support command-line interfaces.

How to configure IP in CLI? ›

To configure an IP address for a network interface, enter the following command: ifconfig interface_name IP_address interface_name is the name of the network interface. IP_address is the IP address that you want to assign to the network interface.

View Details ›

Why is CLI needed? ›

A CLI is used whenever a large vocabulary of commands or queries, coupled with a wide (or arbitrary) range of options, can be entered more rapidly as text than with a pure GUI. This is typically the case with operating system command shells.

How to control user password in cmd? ›

2 ways of achieving this:

Win + R | control userpasswords2 | enter.
Win + R | netplwiz | enter.

Learn More ›

How to create password using cmd? ›

In Command Prompt window, type net user Username NewPassword and press the Enter key. Note: In above Command, replace Username with your actual User Name and NewPass with the New Password that you want to use. Once this Command is successfully executed, you will be able to login to your computer using New Password.

Discover More Details ›

What is the enable password command in Cisco? ›

To set a local password to control access to various privilege levels, use the enable password command in global configuration mode. Use the no form of this command to remove the password requirement.

Show Me More ›

What is the default password for network switch? ›

The switch's default IP address is 192.168. 0.1. 4)Enter the username and password (both admin by default) in the pop-up login window.

Learn More Now ›

What is the common password for Cisco switch? ›

The default username is cisco. The default password is cisco.

Explore More ›

What command can you use at the command prompt to encrypt a file? ›

The following list summarizes the command options for CIPHER: /E. Encrypts the specified folders. New files added are encrypted.

Explore More ›

Which command can be used to encrypt all passwords in the configuration file? ›

The command service password-encryption is used to encrypt all the clear text passwords in the running-configuration file.

Which command sets the secret password to cisco? ›

Solution(By Examveda Team)

To set the enable secret <password> , use the enable secret <password> command from global configuration mode.

Read The Full Story ›

How to configure Cisco switch using PuTTY? ›

Let's configure the switch:

Download PuTTY.
Connect the console cable to your Cisco router or switch.
Run the downloaded putty.exe file.
Using the PuTTY navigation, expand "Connection" then select "Serial."
Enter the port number inside the "Serial line to connect to" text box. ...
Next, we'll configure the serial line.

More items...

Oct 11, 2022

Keep Reading ›

Which command is used to activate interface? ›

To enable an interface, it must be activated using the no shutdown command. (This is similar to powering on the interface.) The interface must also be connected to another device (a hub, a switch, or another router) for the physical layer to be active.

Explore More ›

What cable do you connect to a Cisco router or switch to configure it? ›

Step 1 Connect one end of the yellow Ethernet cable to an Ethernet switch port on the router. See Figure 3-1. Step 2 Connect the other end of the cable to the RJ-45 port on the network interface card (NIC) that is installed in the PC, server, or workstation.

See Details ›

How do I upload a configuration file to a Cisco switch? ›

Log into the switch through the console port or a Telnet session. Upload the switch configuration to the TFTP server with the copy config tftp command. Specify the IP address or host name of the TFTP server and the destination filename.

How to configure interface IP for a switch? ›

To verify the IP address set on a switch, we can use the show int vlan 1 command: SW1#show int vlan 1 Vlan1 is up, line protocol is up Hardware is CPU Interface, address is 0030.

Explore More ›

How the switch interfaces can be configured? ›

Using the Interface Command. To configure a physical interface (port), use the interface global configuration command to enter interface configuration mode and to specify the interface type, slot, and number. Slot—The slot number on the switch (always 0 on this switch). Port number—The interface number on the switch.

See Details ›

What are the steps involved in configuring switch port security? ›

To configure port security, three steps are required:

define the interface as an access interface by using the switchport mode access interface subcommand.
enable port security by using the switchport port-security interface subcommand.

More items...

Keep Reading ›

How do I validate my password length? ›

The parameters below must be valid in order to have a valid password.

An alphanumeric password must be used.
The first letter always needs to be capital.
A special character must be included in the password (@, $, !, &, etc).
The length of the password must exceed 8 characters.

Feb 7, 2023

Explore More ›

What is the default password length? ›

In most environments, an eight-character password is recommended because it's long enough to provide adequate security and still short enough for users to easily remember. A minimum password length greater than 14 isn't supported at this time. This value will help provide adequate defense against a brute force attack.

Know More ›

What is the maximum password length for SSH? ›

But the SSH password that is created by default is 88 characters. The usage of this sFTP is to load photos taken by an IP camera, but this camera accepts a password of max. 16 characters.

How to set minimum password length in cmd? ›

First, launch the group policy editor by pressing Windows+R, typing “gpedit. msc” into the box, and then pressing the Enter key. Navigate to Computer configuration > Windows settings > Security settings > Account policies > Password policy. Once here, locate the setting “Minimum Password Length” and double-click on it.

Discover More Details ›

What is the minimum password space? ›

Common guidelines advocated by proponents of software system security have included: Consider a minimum password length of 8 characters as a general guide. Both the US and UK cyber security departments recommend long and easily memorable passwords over short complex ones.

Show Me More ›

What should be the minimum length of the password as per the PCI standard? ›

For a password to meet PCI compliance standards, it must possess the following attributes: The password must be a minimum of seven characters in length. It must contain both numbers and letters.

Tell Me More ›

What is the maximum number of VLANs that can be configured allowed on a Switchport? ›

A switch supports a maximum of 4096 VLANs, among which VLANs 0 and 4095 are reserved for system use, and VLAN 1 is the default VLAN.

How do I configure multiple interfaces at once? ›

interface range command format

The format of the interface range command is as follows: range should be specified with “-” (hyphen). To configure multiple non-contiguous interfaces at once, delimit them with a comma (“,”). After separating with a comma, you need to specify the interface from .

Find Out More ›

How to set IP address on Cisco switch in CLI? ›

Configure an IP address on a switch

enter the VLAN 1 configuration mode with the interface vlan 1 global configuration command.
assign an IP address with the ip address IP_ADDRESS SUBNET_MASK interface subcommand.
enable the VLAN 1 interface with the no shutdown interface subcommand.

More items...

Which command will configure a switch port? ›

Switch ports can be manually configured with specific duplex and speed settings. Use the duplex interface configuration mode command to manually specify the duplex mode for a switch port. Use the speed interface configuration mode command to manually specify the speed for a switch port.

Discover More Details ›

How do I reset and configure a Cisco switch? ›

Resetting the Cisco IP switch to factory defaults

Reset the switch to factory defaults: Erase the existing configuration: write erase. Reload the switch software: reload. ...
Save the configuration: IP_switch-A-1# copy running-config startup-config.
Reboot the switch and wait for the switch to reload: IP_switch-A-1# reload.

See Details ›

How to configure Cisco 2960 switch with console cable? ›

Follow these steps:

Connect the supplied RJ-45-to DB-9 adapter cable to the 9-pin serial port on the PC. Connect the other end of the cable to the console port on the switch.
a. Configure the PC terminal emulation software for 9600 baud, 8 data bits, no parity, 1 stop bit, and no flow control.
a.

Tell Me More ›

How to change IP address with CLI? ›

Windows 10

Right-click the Start menu and select Command Prompt (Admin).
Enter your admin username and password, if prompted.
A command prompt window will open. At the flashing cursor, type ipconfig /release. ...
Type ipconfig /renew to get a new IP address.
Type exit to exit the command prompt.

Mar 31, 2023

Discover More ›

How to get IP address using CLI? ›

First, click on your Start Menu and type cmd in the search box and press enter. A black and white window will open where you will type ipconfig /all and press enter. There is a space between the command ipconfig and the switch of /all. Your ip address will be the IPv4 address.

How do I configure a port on a switch? ›

This puts the switch into configuration mode. Type interface port-id and press ↵ Enter . Replace port-id with the ID of the port you want to enable, for example, interface fastEthernet 0/1 or interface Gi1/10 . Now your switch knows which interface to configure.

Learn More ›

What is the basic configuration of a switch? ›

Basic switch configuration can be thought of as the minimum network, port, and security provisioning required for the production deployment of a switch.

Keep Reading ›

How to configure VLAN IP address on Cisco switch? ›

Configuring IP Address for VLAN

configure terminal. Enter global configuration mode.
interface vlan vlan-id. Enter interface configuration mode, and enter the VLAN to which the IP information is assigned. ...
ip address { ip-address subnet-mask | dhcp } ...
exit. ...
show interfaces vlan vlan-id. ...
copy running-config startup-config.

Keep Reading ›

How to configure VLAN on Cisco step by step? ›

Step 1: Create VLANs (VLANs 10 and 20) on the L2 switch. Description. ...
Step 2: Assign the VLANs to the L2 switch ports. ...
Step 3: Enable L3 routing and create VLANs (VLANs 10 and 20) on the L3 switch. ...
Step 4: Configure Switch VLAN Interfaces (SVI) ...
Step 5: Configure a routed port for connecting to the firewall on the L3 switch.

Jan 20, 2023

What is the Switchport access VLAN command? ›

The switchport mode access command is usually followed by the command switchport access vlan. This command specifies which VLAN the interface belongs to. If this command is omitted when an interface is statically set to access mode, the interface is assigned to the default VLAN - VLAN 1.

Discover More Details ›