Edge switch baseline: management, hardened access ports, voice VLAN and an uplink trunk.
hostname acc-sw-01
!
no ip domain-lookup
service password-encryption
!
vlan 10
name DATA
vlan 20
name VOICE
vlan 99
name MGMT
!
interface Vlan99
description Management
ip address 10.0.99.11 255.255.255.0
no shutdown
!
ip default-gateway 10.0.99.1
!
interface range GigabitEthernet1/0/1-47
description Access port
switchport mode access
switchport access vlan 10
switchport voice vlan 20
switchport port-security
switchport port-security maximum 3
switchport port-security violation restrict
switchport port-security aging time 5
spanning-tree portfast
spanning-tree bpduguard enable
storm-control broadcast level 5.00
no shutdown
!
interface GigabitEthernet1/0/48
description Uplink to core
switchport mode trunk
switchport trunk allowed vlan 10,20,99
spanning-tree guard root
no shutdown
!
! Access ports must never become a trunk or a root bridge — bpduguard and
! root guard are what enforce that when someone plugs in a switch.
!
line vty 0 15
transport input ssh
exec-timeout 10 0
!
end