How to Give a Cisco Switch a Management IP (SVI + Default Gateway)

Step 1 — Create a dedicated management VLAN (not VLAN 1)

Pick a management VLAN that is not VLAN 1 and create it in the VLAN database. VLAN 1 is the default for every access port out of the box, is present on every trunk, and cannot be pruned cleanly — putting your management IP there means any misconfigured port or rogue device shares an L2 broadcast domain with the switch's brain. A separate VLAN (99 here) isolates management from user traffic and is the CCNA/CCNP best practice.

The VLAN must actually exist before its SVI will ever come up. If you type 'interface vlan 99' without creating VLAN 99, the SVI stays down/down no matter what else you configure.

Give it a name so 'show vlan brief' is readable later. Naming is cosmetic but saves you during troubleshooting.

SW1# configure terminal
SW1(config)# vlan 99
SW1(config-vlan)# name MGMT
SW1(config-vlan)# exit

Step 2 — Put an access port into the management VLAN and bring it up

An SVI has no cable of its own. Its line protocol follows its VLAN: the SVI is 'up/up' only when VLAN 99 exists AND at least one port in VLAN 99 is up (an access port that is connected, or a trunk that permits VLAN 99). With zero up member ports the SVI sits down/down and nothing you do to the IP will make it reachable.

Assign a physical port to VLAN 99 as an access port. In a lab, connect that port to the device you'll manage from (or to your L3 gateway); on real gear this is typically the port toward your out-of-band management switch or the uplink that carries VLAN 99.

Confirm the port isn't administratively shut. IOSv/IOSvL2 ports are often 'shutdown' by default, so an explicit 'no shutdown' matters here — an admin-down member port counts as no up port, and the SVI stays down.

SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 99
SW1(config-if)# no shutdown
SW1(config-if)# exit

Step 3 — Create the SVI and assign the management IP

Now create the Layer 3 interface for VLAN 99 and give the switch its address. This IP belongs to the switch itself, in the management subnet (10.0.99.0/24 in this example), with the switch taking .2 and the gateway reserved at .1.

The 'no shutdown' on the SVI is not optional. A newly created 'interface vlan' can come up administratively shut depending on platform/version, and a shut SVI shows 'administratively down' in 'show ip interface brief' — you'll have a perfect IP that never answers. Always issue 'no shutdown' on the SVI.

Even with 'no shutdown', remember the dependency from Step 2: the SVI's line protocol will not reach 'up' until a member port in VLAN 99 is up. The IP is configured either way; reachability waits on the VLAN.

SW1(config)# interface vlan 99
SW1(config-if)# ip address 10.0.99.2 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit

Step 4 — Set the default gateway so the switch can reply across subnets

A pure Layer 2 switch does not route. Its SVI can receive a management packet and generate a reply, but if the manager lives in a different subnet the switch has no way to forward that reply off its own subnet — it will ARP for a destination it can't reach and the reply dies locally. That's why you can often ping the switch from a host on the SAME subnet but not from anywhere else until the gateway is set.

'ip default-gateway' points the switch's own management traffic at the L3 next hop (here 10.0.99.1, the router or L3 switch SVI that routes the management VLAN). This is a global command, not an interface command.

Important nuance: 'ip default-gateway' is only consulted when IP routing is disabled — which is the normal state of a Layer 2 switch. If this is a multilayer/L3 switch and you (or a template) have enabled 'ip routing', the switch ignores 'ip default-gateway' and you must instead give it a static default route ('ip route 0.0.0.0 0.0.0.0 10.0.99.1'). Match the command to the box.

Save the config once it works so a reload doesn't wipe your management access.

SW1(config)# ip default-gateway 10.0.99.1
SW1(config)# end
SW1# copy running-config startup-config

Step 5 — Verify the SVI is up/up and reachable from another subnet

Check the SVI first. 'show ip interface brief' should show Vlan99 with your IP and BOTH the Status and Protocol columns reading 'up'. If Status is 'administratively down', revisit Step 3 (no shutdown on the SVI). If Status/Protocol is 'down/down', revisit Steps 1–2 (VLAN missing, or no up member port).

Confirm the VLAN exists and has a live member port with 'show vlan brief' and 'show interfaces status' — VLAN 99 should be listed as active with Gi0/1 assigned, and that port should be 'connected'.

The real proof is a cross-subnet test: ping the switch's management IP from a device in a DIFFERENT subnet (a router, a host, or your management station). Success here is what validates the default gateway from Step 4. A local same-subnet ping succeeding but a remote ping failing is the classic 'missing default gateway' signature. Once ping works, try 'ssh' if you've configured SSH/VTY access.

SW1# show ip interface brief | include Vlan99
Vlan99                 10.0.99.2       YES manual up                    up

SW1# show vlan brief
VLAN Name         Status    Ports
99   MGMT         active    Gi0/1

SW1# show interfaces status
Port   Name   Status       Vlan   Duplex  Speed Type
Gi0/1         connected    99     a-full  auto

! Confirm the gateway is present:
SW1# show running-config | include ip default-gateway
ip default-gateway 10.0.99.1

! From a device in ANOTHER subnet (this is the real test):
R1# ping 10.0.99.2

Common problems (and the fix)

1) SVI shows 'administratively down' — you forgot 'no shutdown' on the SVI. The IP is configured but the interface is shut. Fix: go into 'interface vlan 99' and issue 'no shutdown'.

2) You can ping the switch from the same subnet but not from anywhere else — you forgot 'ip default-gateway' (or the box has 'ip routing' on and needs a default route instead). The switch builds a reply it can't route home. Fix: add 'ip default-gateway 10.0.99.1' (L2 switch) or 'ip route 0.0.0.0 0.0.0.0 10.0.99.1' (L3 switch with routing enabled).

3) SVI is stuck 'down/down' even though it's not shut — either VLAN 99 was never created, or no port in VLAN 99 is up. The SVI borrows line-protocol state from its VLAN's member ports. Fix: verify VLAN 99 exists in 'show vlan brief', assign an access port to it, and make sure that port is connected and not shutdown.

4) VLAN mismatch — your access port is in VLAN 10 but the SVI is 'interface vlan 99', so no port backs the SVI. Fix: put the member port in the SAME VLAN as the SVI ('switchport access vlan 99'), or point the SVI at the VLAN your ports actually use. Keep the numbers consistent.

5) You put the management IP on VLAN 1, or on a subnet that doesn't match the gateway. Management ends up in the default broadcast domain (security risk) or the switch and its default gateway aren't in the same subnet, so ARP for the gateway fails. Fix: use a dedicated management VLAN and make sure the SVI IP and 'ip default-gateway' are in the same subnet (10.0.99.2 and 10.0.99.1, both /24).

! Problem 1 — SVI administratively down (missing no shutdown)
SW1# show ip interface brief | include Vlan99
Vlan99                 10.0.99.2       YES manual administratively down down
SW1(config)# interface vlan 99
SW1(config-if)# no shutdown

! Problem 3 — SVI down/down: VLAN missing or no up member port
SW1# show vlan brief            ! is VLAN 99 present, with ports assigned?
SW1# show interfaces status     ! is at least one VLAN 99 port connected?

! Problem 5 — L3 switch with routing on: default-gateway is ignored
SW1# show ip route              ! routing enabled? then use a static default
SW1(config)# ip route 0.0.0.0 0.0.0.0 10.0.99.1