{"id":5722,"date":"2025-07-12T14:31:32","date_gmt":"2025-07-12T12:31:32","guid":{"rendered":"https:\/\/cyber-fi.net\/?p=5722"},"modified":"2025-10-22T17:01:00","modified_gmt":"2025-10-22T15:01:00","slug":"basic-setup-of-a-cisco-catalyst-9800-cl","status":"publish","type":"post","link":"https:\/\/cyber-fi.net\/index.php\/2025\/07\/12\/basic-setup-of-a-cisco-catalyst-9800-cl\/","title":{"rendered":"Basic Setup of a Cisco Catalyst 9800-CL"},"content":{"rendered":"\n<p>There are many guides on the internet for the setup of the Cisco Catalyst 9800-CL. But most of them are pretty old, and things have changed in the meantime. This guide is based on version 17.15.3 of the 9800-CL.<\/p>\n\n\n\n<p>It shows how to do the basic setup on VMware ESXi in three steps. This is certainly not the only way to set it up, just the way I prefer it:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Installing the VM<\/li>\n\n\n\n<li>Adding the minimum needed config on the VMware console<\/li>\n\n\n\n<li>Finishing the setup remotely<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Installing the VM<\/h3>\n\n\n\n<p>First you have to download the install medium from software.cisco.com. I prefer the &#8220;ova&#8221;-file:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"592\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.32.43-1024x592.jpg\" alt=\"\" class=\"wp-image-5727\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.32.43-1024x592.jpg 1024w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.32.43-300x173.jpg 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.32.43-768x444.jpg 768w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.32.43.jpg 1297w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Deploy it on your ESX server. This guide is using a standalone ESXi, not the VCenter.<\/p>\n\n\n\n<p>For a lab setup, these are my deployment options:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"938\" height=\"593\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-10-at-16.54.23.jpg\" alt=\"\" class=\"wp-image-5725\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-10-at-16.54.23.jpg 938w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-10-at-16.54.23-300x190.jpg 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-10-at-16.54.23-768x486.jpg 768w\" sizes=\"auto, (max-width: 938px) 100vw, 938px\" \/><\/figure>\n\n\n\n<p>GigabitEthernet1 is for OOB management, GigabitEthernet3 is for HA. For a lab setup, I&#8217;ll disable them later.<\/p>\n\n\n\n<p>GigabitEthernet2 is our primary interface for AP and Client communication. It&#8217;s a VMware interface that uses tagged frames:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"807\" height=\"270\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.15.51.jpg\" alt=\"\" class=\"wp-image-5726\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.15.51.jpg 807w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.15.51-300x100.jpg 300w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-12-at-11.15.51-768x257.jpg 768w\" sizes=\"auto, (max-width: 807px) 100vw, 807px\" \/><\/figure>\n\n\n\n<p>The important settings are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>VLAN ID 4095 to make it a Trunk<\/li>\n\n\n\n<li>Allow promiscuous mode = Yes<\/li>\n\n\n\n<li>Allow Forged transmits = Yes<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Minimum needed config on the VMware console<\/h3>\n\n\n\n<p>This part is meant to make the VM accessible through SSH, as the configuration is much more comfortable through SSH than through the VMware console:<\/p>\n\n\n\n<p>Say no to the initial configuration dialog:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"737\" height=\"55\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-11-at-16.42.47.jpg\" alt=\"\" class=\"wp-image-5723\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-11-at-16.42.47.jpg 737w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-11-at-16.42.47-300x22.jpg 300w\" sizes=\"auto, (max-width: 737px) 100vw, 737px\" \/><\/figure>\n\n\n\n<p>Enter your preferred secret:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"745\" height=\"177\" src=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-11-at-16.45.19.jpg\" alt=\"\" class=\"wp-image-5724\" srcset=\"https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-11-at-16.45.19.jpg 745w, https:\/\/cyber-fi.net\/wp-content\/uploads\/2025\/07\/CleanShot-2025-07-11-at-16.45.19-300x71.jpg 300w\" sizes=\"auto, (max-width: 745px) 100vw, 745px\" \/><\/figure>\n\n\n\n<p>Next we go to the IOS command prompt.<\/p>\n\n\n\n<p>Adding a temporary user to access the VM by SSH. I use a temporary user and password because my real admin user has a password that is much longer and more complex. The likelihood of typos is much higher in the VMware console compared to SSH:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>conf t\nusername temp priv 15 secret temp\naaa new-model\naaa authentication login default local\naaa authorization exec default local<\/code><\/pre>\n\n\n\n<p>Configure the IP-Settings of my management interface:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vlan 1224\n name WLC-Mgmt\n!\ninterface Vlan1224\n ip address 10.255.224.200 255.255.255.0\n!\ndefault interface vlan 1\n!\nip route 0.0.0.0 0.0.0.0 10.255.224.254\n!\ninterface GigabitEthernet2\n switchport trunk native vlan 1239\n switchport mode trunk<\/code><\/pre>\n\n\n\n<p>Your settings might vary. With this basic config, we can continue on SSH.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Finishing the setup remotely<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>\u279c  ~ ssh -l temp 10.255.224.200<\/code><\/pre>\n\n\n\n<p>First I configure my &#8220;real&#8221; admin user and delete the temp user:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>conf t\nusername admin privilege 15 algorithm-type scrypt secret YOUR-NEW-PASSWORD\n!\nno username temp<\/code><\/pre>\n\n\n\n<p>Next, I add the host-settings:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>hostname c9800-cl-k63-1\nip domain name wireless-training.net\nip name-server 10.255.224.101 10.255.192.101\n!\nclock timezone CET 1 0\nclock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00\n!\nntp server ptbtime2.ptb.de\nntp server ptbtime1.ptb.de\n!\nip access-list standard restrict_ipv4_webui\n 10 permit 10.255.0.0 0.0.255.255\n!\nno ip http server\nip http access-class ipv4 restrict_ipv4_webui\nip http authentication aaa login-authentication default\nip http authentication aaa exec-authorization default\nip http secure-server\nno ip http client source-interface Vlan1\n!\ninterface GigabitEthernet1\n shutdown\n!\ninterface GigabitEthernet3\n shutdown<\/code><\/pre>\n\n\n\n<p>Again, adjust this to your needs.<\/p>\n\n\n\n<p>Next we need a trustpoint which is used for the DTLS-communication:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>! This is done in Privilege mode:\nwireless config vwlc-ssc key-size 4096 signature-algo sha384 password 0 YOUR-PASSWORD<\/code><\/pre>\n\n\n\n<p>The wireless management interface and the wireless country gets defined:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>conf t\nwireless management interface vlan 1224\n!\nwireless country DE<\/code><\/pre>\n\n\n\n<p>As a last step, don&#8217;t forget to save the config, or the GUI won&#8217;t get out of the day0-loop:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wr<\/code><\/pre>\n\n\n\n<p>Now the 9800-CL can be accessed through the GUI.<\/p>\n\n\n\n<p>Some additional config that I always need (regardless of LAB or production), and what I always configure through the CLI:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>radius server ISE-1\n address ipv4 ISE-IP-1 auth-port 1812 acct-port 1813\n key 0 YOUR-RADIUS-SECRET\n!\naaa server radius dynamic-author\n client ISE-IP-1\n server-key 0 YOUR-RADIUS-SECRET\n!\naaa group server radius ISE-ALL\n server name ISE-1\n!\naaa authentication dot1x ISE-AuthC group ISE-ALL\naaa authorization network ISE-AuthZ group ISE-ALL\naaa accounting identity default start-stop group ISE-ALL\n!\nservice tcp-keepalives-in\nservice tcp-keepalives-out\n!\nline vty 0 50\n transport input ssh<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<p>Have fun with your Cisco Catalyst 9800-CL!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>There are many guides on the internet for the setup of the Cisco Catalyst 9800-CL. But most of them are pretty old, and things have changed in the meantime. This guide is based on version 17.15.3 of the 9800-CL. It shows how to do the basic setup on VMware ESXi in three steps. This is <\/p>\n<div class=\"read-more-text\"><a href=\"https:\/\/cyber-fi.net\/index.php\/2025\/07\/12\/basic-setup-of-a-cisco-catalyst-9800-cl\/\" class=\"read-more\">continue reading<\/a><\/div>\n","protected":false},"author":2,"featured_media":5732,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"twitterCardType":"","cardImageID":0,"cardImage":"","cardTitle":"","cardDesc":"","cardImageAlt":"","cardPlayer":"","cardPlayerWidth":0,"cardPlayerHeight":0,"cardPlayerStream":"","cardPlayerCodec":"","footnotes":""},"categories":[5,17,685,717],"tags":[754,756,755],"class_list":["post-5722","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cisco","category-vmware","category-cisco-wireless","category-wireless","tag-9800-cl","tag-cisco-catalyst","tag-esx"],"_links":{"self":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts\/5722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/comments?post=5722"}],"version-history":[{"count":4,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts\/5722\/revisions"}],"predecessor-version":[{"id":5737,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts\/5722\/revisions\/5737"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/media\/5732"}],"wp:attachment":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/media?parent=5722"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/categories?post=5722"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/tags?post=5722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}