Joe Poyzer

Specializing in networking, systems, cloud, and automation.

📌 Overview

A Python automation script that bootstraps a factory-default Cisco Catalyst 1300 switch over SSH — handling the forced first-login password change, pushing a baseline VLAN/trunk config, and replacing the factory cisco account with two dedicated, randomly-generated-password accounts.

Repo: github.com/poyzerj/NetworkAutomation/catalyst1300_bootstrap

🔧 What It Does

  • Connects via SSH using the factory default cisco/cisco credentials
  • Drives the forced first-login password-change dialog automatically
  • Creates VLANs 10, 20, and 30
  • Configures gi0/48 as a trunk allowing those VLANs
  • Creates two priv15 accounts — an admin account and a dedicated monitoring account — each with a randomly generated password
  • Removes the factory cisco account once both new accounts are confirmed working
  • Saves the running config to startup config

🚧 The Prompt-Detection Problem

The Catalyst 1300 / CBS family runs an "S300-style" CLI that looks like standard IOS but isn't quite. Netmiko's cisco_s300 driver is a reasonable starting point, but prompt auto-detection can fail — especially on first login, when the switch forces an interactive old/new/confirm password dialog before it ever presents a normal CLI prompt.

The fix: connect.py tries the cisco_s300 driver first, then falls back to a raw, manually-driven session to walk through that forced password-change dialog step by step if the automatic driver can't lock onto a prompt.

🔒 Credential Handling

Passwords for the new admin and monitoring accounts are generated fresh on every run — they're never read from or written to the config file. After a run, they're printed once to the console and written to a gitignored local credentials log, meant to be moved into a password manager and deleted. Every config command sent and the switch's response is also logged, with generated passwords redacted from that log specifically (only the one-time credentials file has them in full).

📈 Result

A repeatable, safe way to bring a brand-new Catalyst 1300 from factory defaults to a baseline secure state — VLANs configured, trunk in place, and no factory default credentials left active — without needing to manually walk through the CLI's quirky first-login flow every time.

📝 Notes / Lessons Learned

  • Not every "IOS-like" CLI is actually IOS — the S300 family's prompt behavior during first login required a manual fallback path rather than trusting the standard Netmiko driver in every case
  • Generating credentials at runtime rather than storing them in a config file removes an entire class of accidental credential leakage (e.g., committing a config file with a real password in it)
  • Only removing the factory account after confirming the replacement accounts work avoids a failure mode where a script bug could lock out all access to the switch