A complete, step-by-step build for pairing a Cisco 1921 ISR with a Catalyst WS-C2960L-24PS-LL PoE+ switch. From unboxing and console cable to a working routed network with DHCP, NAT, and a management address on the switch. Eleven steps, console cable and CLI only. If you've never opened a console session before, start with the Cisco 1921 Intro and come back.
Before you power anything on, make sure you have everything on hand. A missing console cable will end your evening fast.
screen/minicom (Linux/Mac)The 1921 reached end-of-support in 2022. It's excellent for labs and isolated networks, but don't put it on a production internet edge if security matters.
Plug the RJ45 end into the CONSOLE port on the device and the USB end into your laptop. Find the COM port (Windows: Device Manager → Ports) or device node (Linux: ls /dev/ttyUSB*).
Open a serial terminal with these settings:
| Setting | Value |
|---|---|
| Baud rate | 9600 |
| Data bits | 8 |
| Parity | None |
| Stop bits | 1 |
| Flow control | None |
# Connect via screen sudo screen /dev/ttyUSB0 9600 # Or with minicom sudo minicom -D /dev/ttyUSB0 -b 9600
Power on the device. You'll see boot messages, then a prompt like Router> or Switch>. If you see "Would you like to enter the initial configuration dialog?" — answer no. We'll configure everything manually.
Enter privileged EXEC mode, then global config mode. Set the hostname, domain name, and encrypt passwords.
Router> enable Router# configure terminal Router(config)# hostname R1 R1(config)# ip domain-name lab.local R1(config)# service password-encryption R1(config)# enable secret StrongEnablePass! R1(config)# banner motd #Authorized access only.#
Use enable secret, never enable password. Secret is hashed; password is reversible.
Secret is hashed; password is reversible. That one word is the whole difference.
Gi0/1 faces the switch. Give it the gateway IP for your LAN subnet.
R1(config)# interface GigabitEthernet0/1 R1(config-if)# description LAN to 2960L Gi0/1 R1(config-if)# ip address 192.168.10.1 255.255.255.0 R1(config-if)# no shutdown R1(config-if)# exit
Gi0/0 is your uplink to the ISP. Choose DHCP (most home/SMB modems) or static. Pick one block below.
R1(config)# interface GigabitEthernet0/0 R1(config-if)# description WAN to ISP R1(config-if)# ip address dhcp R1(config-if)# no shutdown R1(config-if)# exit
R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip address 203.0.113.10 255.255.255.0 R1(config-if)# no shutdown R1(config-if)# exit R1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1
NAT lets your private LAN share the public WAN IP. DHCP gives your devices IP addresses automatically.
! Mark interfaces as inside/outside R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip nat outside R1(config-if)# exit R1(config)# interface GigabitEthernet0/1 R1(config-if)# ip nat inside R1(config-if)# exit ! Permit the LAN and enable PAT R1(config)# access-list 10 permit 192.168.10.0 0.0.0.255 R1(config)# ip nat inside source list 10 interface GigabitEthernet0/0 overload
R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.10 R1(config)# ip dhcp pool LAN_POOL R1(dhcp-config)# network 192.168.10.0 255.255.255.0 R1(dhcp-config)# default-router 192.168.10.1 R1(dhcp-config)# dns-server 1.1.1.1 8.8.8.8 R1(dhcp-config)# lease 7 R1(dhcp-config)# exit
Your laptop on the LAN can open google.com, but nobody on the internet can open a connection to your laptop. Explain what the overload line is doing that makes both of those true at once.
The router has one public address and many private ones behind it. When your laptop sends a packet out, the router swaps in its own public address and remembers “this reply belongs to the laptop” in a table — that's the overload, many inside addresses sharing one outside address. Replies match a table entry, so they get forwarded back. A brand-new connection from the internet matches nothing in the table, so the router has nowhere to send it and drops it. Sharing one address and blocking unsolicited traffic are the same mechanism.
It reserves low addresses for static assignments (the router itself, the switch, printers, etc.) so DHCP hands out .11+ to clients.
So you don't have to stay chained to the console cable.
R1(config)# username admin privilege 15 secret AdminPass! R1(config)# crypto key generate rsa modulus 2048 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input ssh R1(config-line)# login local R1(config-line)# exec-timeout 10 0 R1(config-line)# exit R1(config)# end R1# write memory
Move the console cable to the 2960L. Same serial settings as before. The switch is Layer 2 — it doesn't route, but it needs a management IP in your LAN subnet so you can reach it remotely.
Switch> enable Switch# configure terminal Switch(config)# hostname SW1 SW1(config)# ip domain-name lab.local SW1(config)# service password-encryption SW1(config)# enable secret StrongEnablePass! SW1(config)# no ip domain-lookup
SW1(config)# interface vlan 1 SW1(config-if)# ip address 192.168.10.2 255.255.255.0 SW1(config-if)# no shutdown SW1(config-if)# exit SW1(config)# ip default-gateway 192.168.10.1
The switch forwards frames by MAC address and never looks at IP addresses. So why did you just give it an IP address?
The IP address isn't for switching — the switch would move traffic just as well without it. It's a phone number for the switch itself, so you can SSH to it from your desk instead of walking a console cable over. interface vlan 1 is a virtual port that belongs to the switch's own brain, and the default-gateway line tells that brain how to reach you if you're on a different network. Take the address away and the LAN keeps working; you just can't manage the switch remotely any more.
In production, move management off VLAN 1 — create a dedicated management VLAN (e.g., VLAN 99) and shut VLAN 1. For a first lab build, VLAN 1 is fine.
Gi0/1 connects to the router. Remaining ports will be access ports for endpoints. Portfast helps workstations get a link fast (skips STP listening/learning).
! Uplink to router SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# description Uplink to R1 Gi0/1 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 1 SW1(config-if)# exit ! Access ports for endpoints (Gi0/2 - Gi0/24) SW1(config)# interface range GigabitEthernet0/2 - 24 SW1(config-if-range)# switchport mode access SW1(config-if-range)# switchport access vlan 1 SW1(config-if-range)# spanning-tree portfast SW1(config-if-range)# spanning-tree bpduguard enable SW1(config-if-range)# exit
PoE is on by default on the PS model. Check with show power inline. You have 370W of budget to split across phones, APs, cameras.
SW1(config)# username admin privilege 15 secret AdminPass! SW1(config)# crypto key generate rsa modulus 2048 SW1(config)# ip ssh version 2 SW1(config)# line vty 0 15 SW1(config-line)# transport input ssh SW1(config-line)# login local SW1(config-line)# exit SW1(config)# end SW1# write memory
Now cable it up:
Run through these commands and checks. Your client PC should pull a DHCP lease in the .11–.254 range and reach the internet.
! On the router R1# show ip interface brief R1# show ip route R1# show ip dhcp binding R1# show ip nat translations R1# ping 8.8.8.8 ! On the switch SW1# show interfaces status SW1# show vlan brief SW1# show power inline SW1# ping 192.168.10.1 ! On your client PC $ ipconfig (or ip a / ifconfig) $ ping 192.168.10.1 $ ping google.com
ssh admin@192.168.10.1 and ssh admin@192.168.10.2You have a working router + switch pair. Next steps: add VLANs (router-on-a-stick with sub-interfaces on Gi0/1), set up ACLs, or configure a site-to-site IPsec VPN.
| Item | Value |
|---|---|
| Router LAN (Gi0/1) | 192.168.10.1/24 |
| Switch management (VLAN 1) | 192.168.10.2/24 |
| DHCP range | .11 – .254 (.1–.10 reserved) |
| DNS handed to clients | 1.1.1.1, 8.8.8.8 |
show run | View the running config |
show ip int br | Interface status at a glance |
write memory | Save the config so it survives a reboot |
reload | Reboot the device |
Split the LAN into VLANs on the 2960L and route between them with sub-interfaces on Gi0/1.
PAT, static NAT and port forwarding on the 1921, with verification and troubleshooting.