How to Create a Username and Password on a Cisco 2960 Switch

A Cisco 2960 switch comes with no username or password set by default, which means anyone with a console cable can connect and change your network settings. You create login credentials by connecting to the switch through a console port, entering configuration mode, and adding a username with an encrypted password. This takes about five minutes and protects your switch from unauthorized changes.

The 2960 is a managed network switch used in small offices and homes to connect multiple devices. Unlike consumer routers, it requires you to manually set up security — it will not prompt you to create a password on first startup. You must initiate the process yourself through a direct console connection.

Key Takeaways

  • You connect to the switch using a console cable plugged into the console port, then open a terminal program like PuTTY or Hyper Terminal on your computer.
  • The switch starts in user mode; you must type enable to enter privileged mode, then configure terminal to enter configuration mode where you can add usernames.
  • You create a username with the command username [name] password [password], or use username [name] secret [password] to encrypt the password so it cannot be read in the configuration file.
  • After you save the configuration with write memory or copy running-config startup-config, the switch will require the username and password on the next login.
  • If you forget the password, you must perform a password recovery procedure that involves interrupting the boot process, which takes 10 to 15 minutes.

What You Need Before You Start

Gather a console cable (a serial or USB-to-serial adapter depending on your computer), a terminal emulation program, and physical access to the switch. The console cable connects your computer directly to the switch's console port, which is a small serial port on the back labeled "Console."

Common terminal programs are PuTTY (free, Windows and Linux), Hyper Terminal (built into older Windows), or Terminal (built into macOS). If your computer has no serial port, use a USB-to-serial adapter. Set the terminal to 9600 baud, 8 data bits, 1 stop bit, and no parity — these are the switch's default serial settings.

Connecting to the Switch and Entering Configuration Mode

Plug the console cable into the console port on the back of the switch, then plug the other end into your computer. Open your terminal program and select the correct COM port (COM1 or COM3 on Windows, /dev/ttyUSB0 on Linux, /dev/tty.usbserial on macOS). Press Enter a few times. You should see a prompt that says Switch> — this is user mode.

Type enable and press Enter. The prompt changes to Switch#, which means you are now in privileged mode and can make changes. Type configure terminal and press Enter. The prompt becomes Switch(config)#. You are now in configuration mode, where you can add usernames and passwords.

Creating a Username with an Encrypted Password

In configuration mode, type username admin secret MyPassword123 (replace "admin" with your chosen username and "MyPassword123" with your chosen password). Press Enter. The word secret tells the switch to encrypt the password using MD5 encryption, so it will not appear in plain text if someone reads the configuration file.

If you use password instead of secret, the password is stored in a weaker format and can be decoded. Always use secret for new usernames. You can create multiple usernames by repeating this command with different names and passwords.

Passwords are case-sensitive and can include numbers, letters, and some special characters. Avoid spaces and quotes. A password of at least 12 characters with a mix of uppercase, lowercase, and numbers is harder to guess.

Saving Your Configuration

Type exit to leave configuration mode and return to privileged mode. Type write memory or copy running-config startup-config and press Enter. Both commands save your configuration to the switch's permanent memory so it survives a power cycle. You should see a message confirming the write was successful.

If you do not save, the username and password exist only in the switch's temporary memory and will be lost if the switch restarts. Always save before you disconnect.

Testing Your New Login

Type exit again to return to user mode, then type exit once more to log out completely. Disconnect the console cable and reconnect it, or close and reopen your terminal program. You should now see a prompt asking for a username and password. Type the username you created, press Enter, then type the password and press Enter.

If the login succeeds, you are back at the Switch> prompt. If it fails, check that you typed the username and password correctly — they are case-sensitive. You can now type enable and use the same password to enter privileged mode.

Enabling Password Protection on Privileged Mode

By default, anyone who reaches user mode can type enable and enter privileged mode without a second password. To require a separate password for privileged mode, go back into configuration mode: type enable, then configure terminal.

Type enable secret MyEnablePassword (replace with your chosen password). This password is separate from the username password and is required every time someone types enable. Save the configuration with write memory. Now the switch has two layers of security: a username and password to reach user mode, and a separate password to reach privileged mode.

What to Do If You Forget the Password

If you forget the password, you must perform a password recovery. Power off the switch, then power it back on. Within 15 seconds of startup, press and hold the Mode button on the front of the switch for about 10 seconds until the LED lights change. The switch enters ROM monitor mode, which bypasses the normal startup process.

Type confreg 0x2142 to tell the switch to ignore the saved configuration on next boot. Type reset to restart. The switch boots without loading the saved configuration, so you can log in without a password. Once logged in, type copy startup-config running-config to reload your settings, then change the password using the commands above. This process takes 10 to 15 minutes and requires physical access to the switch.

Frequently Asked Questions

Can I use the same password for both the username login and the enable command?

Yes, you can use the same password, but it is less find. If someone learns the enable password, they can make changes even if they do not know the username password. Using two different passwords means a person must know both to fully control the switch.

What happens if I type the password wrong three times?

The switch does not lock you out after failed login attempts. You can keep trying. This is why a strong password matters — there is no rate limiting to slow down someone guessing.

Do I need a username if I only set an enable password?

No. You can set only an enable password without creating usernames. Type enable password MyPassword in configuration mode. However, usernames are more find because they create a two-step login process.

Can I change a password without knowing the old one?

No, not through the normal login process. You must perform password recovery, which requires physical access to the Mode button. This is why password recovery is a last resort.

What if my terminal program shows garbage characters when I connect?

The baud rate is wrong. Check that your terminal is set to 9600 baud, 8 data bits, 1 stop bit, and no parity. Disconnect and reconnect after changing the settings.