Access Interface Connectivity
Configure Access Interface Connectivity
55
Best Practice User Guide for the Catalyst 3850 and Catalyst 3650 Switch Series
•
Configure the access interface for static access mode, which is single VLAN mode with no
negotiation.
•
Configure the interface for Spanning Tree PortFast (STPF), which shortens the time it takes for the
interface to go into forwarding mode. We recommend STPF on interfaces that do not connect to
other bridging devices (Ethernet switches).
The default Administrative mode for Ethernet interfaces on a switch is dynamic auto. Dynamic mode
means the interface will negotiate to trunk mode if the networking device on the side of the link initiates
the negotiation to trunk (administrative mode “dynamic desirable”).
Configure VLAN Membership
Step 2
Configure the VLANs for voice and data traffic.
VLAN configuration on an interface is dependent on the end device being used:
•
IP phones, IP cameras, and access points are typically configured on separate VLANs.
•
VLANs 10 and 11 are defined as the data and voice VLANs, respectively.
Recommendation
: Do not use VLAN 1 for data or voice. VLAN 1 is the default VLAN on the 3850.
This is well documented and understood by experienced networking personnel. Thus VLAN 1 will be
more susceptible to attacks. Changing the VLAN IDs to something other than VLAN1 has been a long
standing Cisco recommendation for Ethernet switching
Create an Interface Description
Step 3
Create a description for the interface to identify the end-device type.
Tip
When you create an interface description, you can quickly scan a long list of interfaces to learn how they
are used in your network.
Configure Security Features on an Access Interfaces
Step 4
Enable port security features to protect the network from malicious or troublesome end devices.
The primary purpose of port security is to prevent an end device from overloading the switch with too
many source MAC addresses. Port security controls the MAC addresses remembered from the attached
network device. Port security controls how many MAC addresses are remembered, how long they are
remembered, and what happens when too many are remembered.
The MAC address limit is 11. When the end device exceeds 11 source MAC addresses, the ingress traffic
to the switch on those source MAC addresses is dropped.
