Setting up the ability to ssh into a layer 2 switch

ndalmolin_13 used Ask the Experts™
Hello Cisco Experts,

This is going to seem like a basic question, but I’m going to ask it any ways.  Let’s say I have the following setup:
•      A layer 3 (Cisco 3560) distribution layer switch.  This switch is named DIST-SW1.
•      DIST-SW1 has two vlans (vlan 10 and vlan 20).
•      The network associated with vlan 10 is /24
•      The network associated with vlan20 is /24
•      Loopback0 on DIST-SW1 has the IP of
•      A layer 2 (Cisco 2960) access layer switch.  This switch in named ACCS-SW1
•      ACCS-SW1 is connected to DIST-SW1 via a trunk
•      All of the ports on ACCS-SW1 are on vlan10
•      Loopback0 on ACCS-SW1 has the IP address of

If I want to ssh into DIST-SW1, I do so using the ip of  I want to be able to SSH into ACCS-SW1 as well.  When I try to ssh to, there is no connection.  When I try to ping, I get no reply.  If I look at the routing table in DIST-SW1, I don’t see a route to get me to  This explains why the ping doesn’t work.  My thought to be able to ssh into ACCS-SW1 is to change the ip of loopback0 to an IP on the network.  Unfortunately I don’t have a lab to test this on right now, so I’m asking.  Is this the right approach?

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
I never create loopback in the same address range as any of my VLAN on switch (I never tried to do that).
Usual way to manage switches is to create separate (management) VLAN for switch management, and for that purpose you need to create VLAN interface.
For management VLAN to be in up state you need to add ports to that VLAN (adding that VLAN to trunk port should do the trick).
If you create loopback in some other ip address range you need to have routes on that switch (or default gateway depending on config) so traffic can reach anything, and also you would need routes on other devices, so that destination can be reachable.
Luke SmithSenior Manager, Production Engineering

For DIST-SW1 to see the rest of you would need to have interesting traffic passing through the box, which a virtual interface isn't going to generate that for you. You would need a static route to point to the respective location you want.

I would recommend what Predrag Jovic said and create a management VLAN for your switches and add it to the truck and you should be able to SSH to either device.

Also, you can't have 2 interfaces within the same subnet. If you are using on VLAN10 then you can't put 1 of those 255 IP addresses as a Loopback, the Cisco will spit out an error like this:

% overlaps with Vlan10


Thanks for the info

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial