Cisco Catalyst — C1000, 2960 and 9200

Configuration example for preparing a factory-default Cisco Catalyst switch so that it works with PrivateLAN. Register the switch in PrivateLAN with type Cisco-IOS.

This guide covers the three families PrivateLAN's Cisco driver is built and tested against:

Run show version first and check which of the three you have — a number of commands below differ per family, and each one says so where it matters.

Everything in this guide is entered once, on a factory-default switch, before you add it to PrivateLAN. Individual switch port configuration is not part of it: PrivateLAN programs access ports itself from the device group templates, and anything you configure on a port by hand is overwritten the next time that port is programmed.

Values used in this guide

Replace these with your own before pasting anything. The same values are used consistently in every block below, so you can follow one scenario from start to finish.

The appliance only accepts syslog and RADIUS traffic on eth0, and only from RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). A switch with a public management address cannot reach those services, whatever you configure on the switch itself.

1. Console access and host name

Connect to the console port at 9600 8N1, no flow control. On a factory-default switch, answer no to the initial configuration dialog to get a plain CLI.

enable
configure terminal
!
hostname SW-FLOOR1-01
ip domain-name example.local
no ip domain-lookup
!
line con 0
 exec-timeout 15 0
 logging synchronous
 login local
exit

no ip domain-lookup stops the switch from trying to DNS-resolve a mistyped command, which otherwise blocks the console for seconds at a time. logging synchronous keeps log messages from scrambling the line you are typing.

Leave the console speed at its default of 9600. PrivateLAN never uses the console, and a non-default speed only makes recovery harder.

2. Local account, enable secret and privilege level

This is the step that most often goes wrong, so read the warning before you configure it.

username privatelan privilege 1 secret ExampleSwitchPassword
enable secret ExampleEnablePassword

Give the PrivateLAN account privilege level 1, not 15. PrivateLAN's Cisco driver always issues enable immediately after logging in and then waits for the Password: prompt. An account that is already at privilege 15 lands straight back at the # prompt, the password prompt never appears, and the connection fails with a timeout — the switch looks unreachable even though SSH itself is working perfectly. Privilege 1 plus an enable secret is also the better practice: the login account on its own can do nothing.

Fill in the account password as the switch's password in PrivateLAN, and the enable secret in the Enable password field on the same page.

On images that support it, store both as SHA-256 instead of the older MD5 hash:

username privatelan privilege 1 algorithm-type sha256 secret ExampleSwitchPassword
enable algorithm-type sha256 secret ExampleEnablePassword

If the switch rejects algorithm-type, your image is too old for it — use the plain secret form above, which is still a hash and still safe to keep in the configuration.

Finally, remove any account the vendor or a previous owner left behind:

no username admin
no username cisco

3. SSH

PrivateLAN connects over SSH only. Telnet is never used and should stay off.

crypto key generate rsa modulus 2048
!
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
line vty 0 15
 login local
 transport input ssh
 transport output none
 exec-timeout 10 0
exit

crypto key generate rsa needs the host name and domain name from step 1 to be set already. Use modulus 2048 as a minimum; 4096 is fine on the 9200 but noticeably slow to generate on a C1000 or 2960.

You do not need to set terminal length or length 0 on the vty lines. The driver sends terminal length 0 and terminal width 0 itself on every session, and also recovers if a --More-- prompt slips through anyway.

4. SSH with a key instead of a password

Optional. PrivateLAN can authenticate to a switch with an SSH private key instead of a password — you paste the private key on the switch's page, and PrivateLAN shows you the matching public key to install here.

Use an RSA key for Cisco. ip ssh pubkey-chain accepts RSA public keys; ECDSA and Ed25519 keys are supported by PrivateLAN but not by this part of the IOS SSH server on most images.

Take the public key PrivateLAN shows after saving, strip the leading ssh-rsa and the trailing comment, and paste what remains — the Base64 block — in lines of at most 254 characters:

ip ssh pubkey-chain
 username privatelan
  key-string
   AAAAB3NzaC1yc2EAAAADAQABAAABgQC7vbqajDhA8mBOEDgHkC0PfP1a1QeR2xF9YbZ
   3n1sGQKz0Xp9Yc2MZgTn4rC1qJ8dLPzR6oVaHt5uW0eKxMbN7iAj2FyDsE3vXlUpQr
   ...
   exit
 exit
exit

Leave the local password configured as well. It stays available on the console, which is the only way back in if the key is ever removed or the account is locked out.

5. Management VLAN and IP address

PrivateLAN reaches the switch on this address, and this is also the address you register as a RADIUS client.

vlan 10
 name MGMT
exit
!
interface Vlan10
 description Management
 ip address 192.168.10.21 255.255.255.0
 no shutdown
exit
!
ip default-gateway 192.168.10.1

ip default-gateway only works while ip routing is disabled. The moment you enable routing (see section 13) the switch ignores it and you need a real default route instead: ip route 0.0.0.0 0.0.0.0 192.168.10.1. A switch that becomes unreachable right after routing was enabled is almost always this.

Whichever uplink carries the management VLAN has to allow it:

interface GigabitEthernet1/0/48
 description UPLINK
 switchport mode trunk
 switchport trunk allowed vlan 10,20
exit

Keep the management VLAN out of any VLAN set that PrivateLAN programs onto this switch unless you mean to manage it there. When PrivateLAN removes a VLAN from a switch group it issues no vlan <id> on every member switch — including, if you have configured it that way, the VLAN its own management session is running over.

More than 1005 VLANs: the extended range

Cisco splits VLAN ids into two ranges, and the second one is not usable until you enable it:

A factory-default switch is in VTP server mode, version 1, and in VTP versions 1 and 2 a server or client refuses to create an extended-range VLAN at all. So on a switch you have not touched, vlan 2000 fails. Switch VTP to transparent mode before you let PrivateLAN program anything above 1005:

vtp mode transparent

This one fails silently through PrivateLAN. The appliance programs a VLAN by issuing vlan <id>, and the driver cannot tell a rejection from a normal prompt. On a switch still in VTP server mode, every VLAN above 1005 is refused while the programming run reports success — the VLAN exists in PrivateLAN and does not exist on the switch. Reports > Configuration compliance is where that shows up.

Transparent mode is the right choice here regardless of how many VLANs you have. PrivateLAN programs each switch in a switch group individually over SSH, so VTP propagation is redundant at best; at worst a VTP server elsewhere in the network overwrites the VLAN database PrivateLAN just wrote. VTP version 3 also allows extended-range VLANs in server mode, but it solves a problem PrivateLAN does not have.

After enabling transparent mode, save. Extended-range VLANs live in the running configuration rather than in vlan.dat, so without a write memory they are gone after a reload:

end
write memory

Enabling the range does not raise the platform limit, which is a separate number and often lower than 4094:

The C9200L is the cheaper and far more commonly ordered half of the 9200 range, and it caps at 1024 VLAN ids — no VTP setting changes that. If you need more than a thousand VLANs, the model matters more than the configuration does.

The universal check, on any model in this guide, is show vtp status. It reports both the VTP mode and the line "Maximum VLANs supported locally", which is the real ceiling for that switch and image.

6. Protecting passwords in the running configuration

Three separate mechanisms, and only the last one really protects anything:

service password-encryption

This turns plaintext passwords into type 7 strings. Type 7 is obfuscation, not encryption — it is trivially reversible and should never be treated as a secret. Enable it anyway so that nothing sits in the clear, but do not rely on it.

enable secret and username ... secret (section 2) store a one-way hash and are genuinely safe. Use secret, never password, for anything that authenticates a person or a system.

The RADIUS shared secret is the interesting case, because it has to remain readable to the switch and would otherwise be type 7. On images that support AES password encryption, store it as type 6:

key config-key password-encrypt ExampleMasterKey
password encryption aes

The master key is not stored in the configuration and cannot be recovered. If you lose it, every type 6 secret on the switch has to be entered again. Record it wherever you keep the rest of your infrastructure credentials before you continue.

Type 6 is available on IOS-XE and on later 15.x images. If password encryption aes is rejected, leave service password-encryption on and accept that the RADIUS key is type 7 — the shared secret is only worth as much as the management network it can be read from, which is the argument for locking down section 15 properly.

When a switch configuration leaves the appliance — for example through a QR Support report — PrivateLAN strips radius-server key, snmp-server community and key 7 lines before it is encoded, so those never travel with the report regardless of how they are stored here.

7. Time and time zone

Log timestamps only line up with the appliance's own if both agree on the time.

clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
!
ntp server nl.pool.ntp.org
!
service timestamps log datetime msec localtime show-timezone
service timestamps debug datetime msec localtime show-timezone

Point the switch at the same time server the appliance uses, not at the appliance. The PrivateLAN appliance is an NTP client; it does not run an NTP server. You can see which server it uses under System > Networking. Pointing a switch at the appliance produces a switch that silently never syncs.

PrivateLAN's Reports > Configuration compliance page checks this line and accepts either the appliance's own addresses or the time server the appliance is configured with — so a correctly configured switch shows as a match.

If you use a host name here rather than an IP address, the switch needs a name server:

ip name-server 192.168.10.1
ip domain-lookup

That re-enables the DNS lookups turned off in section 1, so only do it if you actually need names.

8. Sending syslog to the appliance

logging host 192.168.10.5
logging trap informational
logging source-interface Vlan10
logging buffered 32768 informational
no logging console

logging source-interface matters: without it the switch may send from whichever interface the route happens to pick, and the appliance's syslog view then shows an address you do not recognise. no logging console stops log messages from flooding a console session — they are still kept in the buffer and still sent to the appliance.

The appliance rate-limits syslog per sending device: more than roughly 200 UDP messages per second from one source are dropped, so a switch in a logging loop cannot drown out the rest of the fleet. If a switch shows up under the dashboard's syslog flood protection tile, lower logging trap to warnings rather than raising anything.

Reports > Configuration compliance reports this line as Logging host, and only counts it as a match when it points at this appliance.

9. RADIUS and 802.1x

This is what makes MAB, PEAP and EAP-TLS devices work. The switch has to be registered as a RADIUS client in PrivateLAN as well, under 802.1x / RADIUS, with the same management IP address and the same shared secret.

Enable aaa new-model and its login lines in one go. aaa new-model immediately changes how the vty and console lines authenticate. Entering it on its own, without the two aaa authentication lines below, locks you out at the next login. Paste the whole block.

aaa new-model
aaa authentication login default local
aaa authentication enable default enable
!
radius server PRIVATELAN
 address ipv4 192.168.10.5 auth-port 1812 acct-port 1813
 timeout 5
 retransmit 3
 key ExampleSharedSecret
exit
!
aaa group server radius PRIVATELAN-GROUP
 server name PRIVATELAN
exit
!
aaa authentication dot1x default group PRIVATELAN-GROUP
aaa authorization network default group PRIVATELAN-GROUP
aaa accounting dot1x default start-stop group PRIVATELAN-GROUP
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server vsa send authentication
radius-server vsa send accounting
!
ip radius source-interface Vlan10
!
dot1x system-auth-control

aaa authorization network default group PRIVATELAN-GROUP is not optional. PrivateLAN returns the device's VLAN in the RADIUS reply (Tunnel-Private-Group-ID), and without network authorization the switch discards it — the device authenticates successfully and then lands in the wrong VLAN.

On older 2960 images that do not have the radius server block, use the single-line form instead:

radius-server host 192.168.10.5 auth-port 1812 acct-port 1813 key ExampleSharedSecret
radius-server timeout 5
radius-server retransmit 3

MAC address format for MAB

PrivateLAN stores a MAB device's RADIUS username and password as the MAC address in twelve lowercase hexadecimal characters with no separators — 00155d5a6500. The RADIUS server matches that string exactly, so a switch that sends 0015.5D5A.6500 or 00-15-5D-5A-65-00 is rejected even though the device is registered correctly.

Cisco's default is twelve characters without separators, but the case differs per image. Check what actually arrives under 802.1x / RADIUS on the appliance, where recent authentication events show the user name the switch sent. If it arrives in upper case, force it:

mab request format attribute 1 groupsize 12 separator - lowercase

The exact keywords accepted by mab request format attribute 1 vary per image — use ? on your switch to see which ones it offers.

Port configuration is pushed by PrivateLAN

You do not configure dot1x, mab or switchport port-security on individual ports. PrivateLAN writes those when it programs a device onto a port, from the templates under Devices > Device groups. A MAB port ends up looking like this:

interface GigabitEthernet1/0/12
 description PRINTER-01
 switchport access vlan 20
 switchport mode access
 switchport nonegotiate
 authentication port-control auto
 dot1x pae authenticator
 authentication event fail action next-method
 authentication event no-response action authorize vlan 20
 authentication host-mode single-host
 mab
 no cdp enable
 no keepalive
 no lldp transmit
 spanning-tree bpdufilter enable
 spanning-tree portfast

Catalyst 9200 only. Those templates use the classic authentication ... syntax. IOS-XE also has the newer IBNS 2.0 access-session syntax, and a switch that has been permanently converted with authentication convert-to new-style rejects every one of the lines above. The rejection is not visible during programming, so the port simply never authenticates anything. If your switch has been converted, either rebuild the templates in the new syntax or start from a switch that has not been converted. authentication display legacy restores the legacy display mode on a switch that has not yet been permanently converted.

After programming a device, Reports > Configuration compliance shows what PrivateLAN intended against what the switch actually has. That report is the reliable way to catch a rejected command, because the switch does not report one back over SSH in a form the driver can distinguish from a normal prompt.

10. The NOIPV6 access list

PrivateLAN's shipped EAP-TLS and PEAP device templates apply an IPv6 access list named NOIPV6 to the port. That list is not created by PrivateLAN — it has to exist on the switch, or the line is rejected and the port is left without the protection it was meant to have.

ipv6 access-list NOIPV6
 deny ipv6 any any
exit

The explicit deny ipv6 any any also overrides IOS's implicit neighbour-discovery permits, which is the intent: the list exists to keep IPv6 off a port entirely.

On Catalyst 2960 platforms an IPv6 access list needs a template change and a reboot before it can be applied at all: sdm prefer dual-ipv4-and-ipv6 default, then reload. On LAN Lite images IPv6 access lists are not available at all. If your switch cannot support this, remove the ipv6 traffic-filter NOIPV6 in line from the EAP-TLS and PEAP templates under Devices > Device groups rather than leaving a line in the template that silently fails on every port.

11. Spanning tree

spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree loopguard default
!
errdisable recovery cause bpduguard
errdisable recovery cause link-flap
errdisable recovery interval 300

Set the root bridge deliberately, on the switch that should be root — not on all of them:

spanning-tree vlan 1-4094 priority 24576

spanning-tree portfast bpduguard default is the usual recommendation for access switches, and it is deliberately not in the block above. PrivateLAN's port templates apply spanning-tree bpdufilter enable per port, and interface-level BPDU filtering stops the port both sending and processing BPDUs — which means BPDU guard on that port can never trigger. Pick one: keep the templates as shipped and rely on filtering, or remove spanning-tree bpdufilter enable from the templates under Devices > Device groups and enable spanning-tree portfast bpduguard default globally here. Configuring both leaves you with the protection you configured second and the impression that you have the other one too.

12. LLDP and CDP

lldp run
lldp timer 30
lldp holdtime 120

lldp run is required. PrivateLAN reads show lldp neighbors per interface to fill the LLDP neighbour column on the interface overview, and without it globally enabled that column stays empty on every port.

The port templates set no lldp transmit on device ports, so the switch still learns what is connected but does not advertise itself to end devices. Uplinks and trunks keep transmitting normally.

CDP can stay enabled for uplinks between Cisco devices; the templates disable it per device port with no cdp enable. If you have no Cisco neighbours at all, no cdp run is one fewer thing advertising the switch's identity.

13. Layer 3 — routing, SVIs, VRRP and HSRP

PrivateLAN's VLAN routing mode is an appliance-wide setting under VLANs, with three options:

PrivateLAN writes all of that itself when you program a VLAN — including ip routing, no ip redirects, no ip unreachables and no proxy-arp on each routed SVI. What you have to make sure of here is only that the platform can do it:

Catalyst 9000 series: Network Essentials or Network Advantage

Every Catalyst 9000 switch ships with one of two perpetual licence tiers, and the split runs straight through the middle of what PrivateLAN offers. This is not specific to the 9200 — the same two-tier model applies across the family (9200, 9300, 9400, 9500, 9600), and the -E part numbers are Network Essentials while the -A part numbers are Network Advantage. On the 9200 both the modular C9200 and the fixed C9200L are sold in each tier.

On Network Essentials, choose VRRP — HSRP is not available. PrivateLAN's routing mode is a single appliance-wide setting, not a per-switch one, so one Network Essentials switch anywhere in the fleet decides it for everything. Selecting HSRP in that situation does not produce a clear error: the switch rejects the standby commands, and the driver cannot tell a rejection from a normal prompt, so the VLAN is programmed with an SVI and no gateway. VRRP is available on both tiers, is vendor-neutral, and is what PrivateLAN defaults to.

The VRRP and HSRP rows above hold for the whole Catalyst 9000 family, which is the part that decides your PrivateLAN routing mode. What Network Advantage adds on top grows as you go up the family: a 9300, for example, also gets BGP, PIM-BIDIR, MPLS and stateful switchover from it, none of which the 9200 supports in either tier — the 9200 does not run BGP at all, whatever the licence says.

Check which tier a switch has with show license summary on IOS-XE 17.x, or show version on 16.x. The table above follows Table 10, "Network Essentials and Advantage Package Features", of Cisco's own Catalyst 9200 Series data sheet, cross-checked against the equivalent table in the 9300 data sheet; second-hand summaries of these circulate widely and several of them are wrong, so check the data sheet for your own model rather than a blog if you need to be certain for a purchase.

Do not configure fhrp version vrrp v3 on a 9200 you manage with PrivateLAN. VRRPv3 is not enabled by default, and PrivateLAN programs the classic VRRPv2 interface syntax (vrrp <group> ip <address>). The two are mutually exclusive: once VRRPv3 is enabled, VRRPv2 is unavailable and every VRRP line PrivateLAN writes is rejected — silently, for the same reason as above. Leave the default alone and VRRP works out of the box.

On a 2960-X that needs to route:

sdm prefer lanbase-routing
end
write memory
reload

After the reload:

configure terminal
 ip routing
 ip route 0.0.0.0 0.0.0.0 192.168.10.1
end

On a layer 2 only switch, leave ip routing off, keep ip default-gateway, set the appliance's routing mode to SVI, and let your core switch or router do the inter-VLAN routing. The management SVI from section 5 works on every family — a management IP address is not routing.

14. Third-party transceivers

Cisco switches disable an SFP they do not recognise. If you use third-party or coloured optics:

service unsupported-transceiver
no errdisable detect cause gbic-invalid

service unsupported-transceiver is a hidden command: it does not appear in ? and the switch answers with a warranty warning when you enter it. It is accepted anyway. Save the configuration afterwards, and on some platforms the transceiver only comes up after the port is bounced or the switch is reloaded.

end
write memory

15. Turning off the web interface and unused services

PrivateLAN manages the switch entirely over SSH. Nothing else needs to be reachable.

no ip http server
no ip http secure-server
!
no ip bootp server
no service pad
no service config
no ip source-route

On Catalyst 1000 and 2960, also disable Smart Install. It listens on TCP 4786 by default, needs no authentication, and is the single most commonly abused service on this hardware:

no vstack

Verify with show vstack config — the client should be disabled. The command does not exist on Catalyst 9200, which has no Smart Install client.

If you use SNMP for anything else in your network, give it a v3 user rather than a community string. PrivateLAN itself does not use SNMP and needs nothing configured here.

16. Save and register in PrivateLAN

end
write memory

Then, in the appliance:

• Switches > Add — host name, management IP address 192.168.10.21, SSH port 22, type Cisco-IOS, user name privatelan, the switch password, and the enable password. Choose the switch group and enter the interface ranges.
• 802.1x / RADIUS > Clients — add the same switch with IP address 192.168.10.21, its netmask, and the shared secret ExampleSharedSecret.
• Reports > Configuration compliance — run it once the first poll has completed, and confirm the logging host and time server rows both come back as a match.

DHCP snooping (optional)

PrivateLAN reads the switch's DHCP snooping table to find out the address of any device you registered with a Dynamic address instead of a fixed one, and to find the address of wireless clients behind an access point. Without snooping those devices simply report that no address is known — nothing else stops working, so enable it only if you use that.

ip dhcp snooping
ip dhcp snooping vlan 10,20,30
no ip dhcp snooping information option
!
interface GigabitEthernet1/0/48
 description Uplink
 ip dhcp snooping trust

no ip dhcp snooping information option is in the block on purpose: option 82 is added by default, and many DHCP servers drop a request carrying it that did not come from a relay.

Two things decide whether this works at all:

• Every port towards your DHCP server must be trusted. That is the uplink, and any port towards another switch on the way to the server. A port left untrusted drops the server's replies and the devices behind it stop getting addresses — so set the trusted ports in the same change that enables snooping, not afterwards.
• Snooping must be enabled on the VLANs the devices are in. A VLAN it is not enabled on produces no bindings, so those devices keep reporting that no address is known.

Check the result on the switch itself:

show ip dhcp snooping
show ip dhcp snooping binding

The binding table does not survive a restart of the switch unless you tell the switch to save it. Without that, PrivateLAN reports that no address is known for a dynamic device until each lease is renewed:

ip dhcp snooping database flash:dhcp-snooping.db
ip dhcp snooping database write-delay 60

Complete example configuration

Everything above in one block, for a Catalyst 9200 acting as a layer 2 access switch. Adjust the sections marked in the guide for a C1000 or 2960, and change every value from the table at the top.

configure terminal
!
hostname SW-FLOOR1-01
ip domain-name example.local
no ip domain-lookup
!
username privatelan privilege 1 secret ExampleSwitchPassword
enable secret ExampleEnablePassword
service password-encryption
!
crypto key generate rsa modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
line con 0
 exec-timeout 15 0
 logging synchronous
 login local
exit
line vty 0 15
 login local
 transport input ssh
 transport output none
 exec-timeout 10 0
exit
!
vtp mode transparent
!
vlan 10
 name MGMT
exit
vlan 20
 name DATA
exit
!
interface Vlan10
 description Management
 ip address 192.168.10.21 255.255.255.0
 no shutdown
exit
ip default-gateway 192.168.10.1
!
interface GigabitEthernet1/0/48
 description UPLINK
 switchport mode trunk
 switchport trunk allowed vlan 10,20
exit
!
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
ntp server nl.pool.ntp.org
service timestamps log datetime msec localtime show-timezone
service timestamps debug datetime msec localtime show-timezone
!
logging host 192.168.10.5
logging trap informational
logging source-interface Vlan10
logging buffered 32768 informational
no logging console
!
aaa new-model
aaa authentication login default local
aaa authentication enable default enable
!
radius server PRIVATELAN
 address ipv4 192.168.10.5 auth-port 1812 acct-port 1813
 timeout 5
 retransmit 3
 key ExampleSharedSecret
exit
aaa group server radius PRIVATELAN-GROUP
 server name PRIVATELAN
exit
aaa authentication dot1x default group PRIVATELAN-GROUP
aaa authorization network default group PRIVATELAN-GROUP
aaa accounting dot1x default start-stop group PRIVATELAN-GROUP
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server vsa send authentication
radius-server vsa send accounting
ip radius source-interface Vlan10
dot1x system-auth-control
!
ipv6 access-list NOIPV6
 deny ipv6 any any
exit
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree loopguard default
errdisable recovery cause bpduguard
errdisable recovery cause link-flap
errdisable recovery interval 300
!
lldp run
lldp timer 30
lldp holdtime 120
!
service unsupported-transceiver
no errdisable detect cause gbic-invalid
!
no ip http server
no ip http secure-server
no ip bootp server
no service pad
no service config
no ip source-route
!
end
write memory

Troubleshooting

Related documentation

• Switch Management — registering the switch, groups, interface tags and stacks
• 802.1x / RADIUS — RADIUS clients and certificates
• VLANs — creating VLANs and choosing the routing mode
• Device Deployment — how ports are programmed from device group templates