Trading Plastic for Enterprise Silicon: Dropping a Cisco Catalyst 3560-CG into the Homelab
Hello everyone,
Between balancing work projects, keeping up with endpoint engineering tasks, and rebuilding my home lab after a recent hardware wipe, I've spent a ton of time recently looking critically at my physical switching layer. For a long time, an unassuming 5-port plastic Tenda switch sat quietly at the top of my 10-inch mini rack. It was cheap, it was quiet, and when my lab only consisted of a few basic virtual machines, it forwarded Ethernet frames without complaint. It served it's intended purpose for the time.
But as my lab expanded—adding a full Active Directory domain, a System Center Configuration Manager (ConfigMgr / SCCM) Primary Site, a 5-node Proxmox cluster, and high-availability Kubernetes control planes—that unmanaged switch became an unacceptable operational liability and bottleneck.
So, I decided it was time to trade consumer-grade plastic for enterprise silicon: dropping a compact, fanless Cisco Catalyst 3560-CG into the core of my lab.
Here is the breakdown of why unmanaged switches fail in an enterprise homelab, how to wipe and apply a hardened Layer 2 baseline to the 3560-CG, and how to configure sub-second Rapid Spanning Tree so your hosts never suffer DHCP timeouts again.
The "Why" Before the "How": Why Unmanaged Switches Fail
It is easy to think of a switch as a simple pipe: plug cable A into port 1, plug cable B into port 2, and let electrons flow. But an unmanaged switch is a complete black box.
In an enterprise environment—or a serious systems engineering lab—an unmanaged switch introduces three critical failure modes:
- Zero Spanning Tree Visibility: Unmanaged switches do not generate or process IEEE 802.1D or 802.1w BPDUs (Bridge Protocol Data Units). If you accidentally plug both ends of a patch cable into the same switch, or cross-connect two physical NICs on a hypervisor without a bonded bridge, the switch blindly floods the frames in an infinite loop. Broadcast storms proceed to saturate link bandwidth, spike CPU utilization across all connected NICs to 100%, not a good situation to have take place.
- No 802.1Q VLAN Tagging: When you want to segregate management traffic, Active Directory replication, guest endpoints, and DMZ proxies, you need IEEE 802.1Q tagged frames. Most unmanaged switches strip 802.1Q VLAN tags or drop them entirely, preventing building of multi-tier security zones.
- Zero Telemetry for Troubleshooting: If a Proxmox node starts dropping packets, an unmanaged switch gives you nothing. No interface error counters, no CRC check telemetry, no speed/duplex mismatch logs, and zero port diagnostics. You are left guessing whether the problem is your Linux kernel driver, bad Cat6 cabling, or physical hardware failure.
Swapping in a Cisco Catalyst 3560-CG gives us true enterprise silicon in a fanless, compact form factor that can sit neately next to a 10-inch rack and not make obtrusive amounts of noise. While this switch is fully capable of wire-speed Layer 3 dynamic routing (which we will unleash in future labs), our Day 1 goal is deliberate: apply a hardened, rock-solid Layer 2 baseline as a drop-in replacement for the Tenda switch.
The Physical Fleet: Who Is Plugging Into This Switch?
Before writing a single line of IOS configuration, you must map out exactly what hardware requires physical connectivity. With the recent addition of two desktop mini PCs and two Dell Latitude laptops, my lab environment now spans 8 distinct physical nodes:
[Internet / ISP]
│
▼ (WAN)
[Zimaboard re0]
[Zimaboard re1] (LAN 10.1.1.1)
│
▼
[Cisco 3560-CG Port Gi0/9] ─── (Uplink Trunk / Access VLAN 1)
│
┌─────┴────────────────────────────────────────────────────────────────────────┐
│ Gi0/1 Gi0/2 Gi0/3 Gi0/4 Gi0/5 Gi0/6 Gi0/7 Gi0/8 Gi0/9 Gi0/10│
└─┬───────┬───────┬───────┬───────┬───────┬───────┬───────┬───────┬───────┬────┘
│ │ │ │ │ │ │ │ │ │
│ │ │ │ │ │ │ │ │ └─ [Local Admin Laptop (RJ-45 Copper Access)]
│ │ │ │ │ │ │ │ └─ [pfSense re1 LAN Uplink]
│ │ │ │ │ │ │ └─ [Spare Access / Downstream Peripheral Switch]
│ │ │ │ │ │ └─ [Dell OptiPlex 7050 (lab05) - i5-7600T / 32GB / 1TB SSD]
│ │ │ │ │ └─ [HP ProDesk 600 G6 (lab04) - i5-10500T / 16GB / K3s CP]
│ │ │ │ └─ [Lenovo lab03 - K3s Workers / Azure Arc]
│ │ │ └─ [Lenovo lab02 - Docker / Traefik / Authelia]
│ │ └─ [Lenovo lab01 - NFS Storage / PBS Backups]
│ └─ [Dell Latitude #2 - Bare Metal OSD / PVE Node 2]
└─ [Dell Latitude #1 - Primary Windows Server Hypervisor]
The Connected Fleet Breakdown:
Gi0/1: Dell Latitude 5420 #1 (pve-dell01) — 11th Gen Core i7, 32 GB RAM. Dedicated Windows hypervisor hosting Active Directory (DC01), ConfigMgr (CM01), and reference clients. (Pro-tip: Using a laptop as a hypervisor gives you built-in battery UPS protection for Active Directory and SQL Server during brief power blips!)Gi0/2: Dell Latitude 5420 #2 (LAT5420-BM01) — 11th Gen Core i7, 32 GB RAM. Dual-role physical bare-metal endpoint for PXE booting, Dell WMI driver injection, and Autopilot attestation.Gi0/3–Gi0/5: 3x Lenovo ThinkCentre M70q Tiny PCs (lab01–lab03) — Storage (PBS / NFS export), Docker reverse proxy stack, and K3s worker compute.Gi0/6: HP ProDesk 600 G6 Desktop Mini (lab04) — 10th Gen Core i5-10500T (6C/12T), 16 GB RAM, hosting K3s high-availability control planes.Gi0/7: Dell OptiPlex 7050 Micro (lab05) — 7th Gen Core i5-7600T, 32 GB RAM, 512 GB NVMe + 1.02 TB SATA SSD, hosting HAProxy/Keepalived load balancers.Gi0/8: Spare Expansion Port — Kept open for bench-testing new machines or daisy-chaining a secondary switch.Gi0/9(Uplink): Zimaboard pfSense (re1) — Main LAN gateway (10.1.1.1/16) managing the static range (10.1.1.10–10.1.1.100), DHCP pool (10.1.2.1–10.1.2.245), DNS, and internet access.Gi0/10(Uplink/Access): Direct Admin Laptop Access — Dual-purpose copper port for wired engineering access.
The Secret Weapon: Dual-Purpose Uplinks on Gi0/10
On the Catalyst 3560-CG, ports Gi0/9 and Gi0/10 are designated as dual-purpose uplinks.
What does "dual-purpose" actually mean? Each of those two ports features two physical receptacles on the faceplate:
- One standard 10/100/1000BASE-T RJ-45 copper jack.
- One SFP (Small Form-factor Pluggable) slot for fiber transceivers.
Only one physical medium can be active at a time per port. Under the hood, Cisco IOS treats Gi0/10 like any other GigabitEthernet switchport—it is not locked to trunking.
By binding Gi0/10 to media-type rj45, configuring it in standard access mode, and turning on spanning-tree portfast, we transform port 10 into a dedicated, high-speed engineering access port for our laptop. You plug in a standard patch cable, and you have direct, full-speed wired line-of-sight to the cluster, leaving ports 1 through 7 dedicated to your servers!
The Baseline Configuration Script
I hashed out a baseline configuration so that I could drop in the Cisco Catalyst Switch without hitting issues from the start, opting to not go straight into VLAN configuration or any layer 3 mechanisms.
After connecting a serial console cable (9600 baud, 8-N-1) and performing a factory reset (write erase and delete flash:vlan.dat), I copied and pasted the created baseline script below (Note that the config has been sanitized, for security of course):
enable
configure terminal
! ----------------------------------------------------------------------------
! 1. SYSTEM IDENTIFICATION & SECURITY HYGIENE
! ----------------------------------------------------------------------------
hostname SW-CORE-01
ip domain-name lab.dariocruz.dev
no ip domain-lookup
service password-encryption
enable secret STRONG_SECRET_PASSWORD
username dario privilege 15 secret ADMIN_PASSWORD
! ----------------------------------------------------------------------------
! 2. SECURE REMOTE ACCESS (SSHv2 ONLY)
! ----------------------------------------------------------------------------
crypto key generate rsa modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
no ip http server
no ip http secure-server
! ----------------------------------------------------------------------------
! 3. CONSOLE & VTY LINES
! ----------------------------------------------------------------------------
line con 0
logging synchronous
exec-timeout 15 0
login local
exit
line vty 0 15
logging synchronous
exec-timeout 15 0
login local
transport input ssh
exit
! ----------------------------------------------------------------------------
! 4. RAPID SPANNING TREE & EDGE PORT HARDENING
! ----------------------------------------------------------------------------
spanning-tree mode rapid-pvst
spanning-tree portfast default
spanning-tree portfast bpduguard default
! ----------------------------------------------------------------------------
! 5. HOST ACCESS PORTS (PORTS 1 THROUGH 8)
! ----------------------------------------------------------------------------
interface range GigabitEthernet0/1 - 8
description LAB-HOST-ACCESS-PORTS
switchport mode access
switchport access vlan 1
switchport nonegotiate
spanning-tree portfast
no shutdown
exit
! ----------------------------------------------------------------------------
! 6. PFSENSE FIREWALL LAN UPLINK (PORT 9)
! ----------------------------------------------------------------------------
interface GigabitEthernet0/9
description UPLINK-TO-PFSENSE-ZIMABOARD-RE1
switchport mode access
switchport access vlan 1
switchport nonegotiate
no shutdown
exit
! ----------------------------------------------------------------------------
! 6b. DIRECT ADMIN LAPTOP ACCESS (PORT 10)
! ----------------------------------------------------------------------------
interface GigabitEthernet0/10
description LOCAL-ADMIN-LAPTOP
switchport mode access
switchport access vlan 1
switchport nonegotiate
spanning-tree portfast
media-type rj45
no shutdown
exit
! ----------------------------------------------------------------------------
! 7. MANAGEMENT SVI & DEFAULT GATEWAY (FLAT 10.1.1.0/16)
! ----------------------------------------------------------------------------
no ip routing
interface Vlan1
description IN-BAND-MANAGEMENT-VLAN1
ip address 10.1.1.9 255.255.0.0
no shutdown
exit
ip default-gateway 10.1.1.1
! ----------------------------------------------------------------------------
! 8. SAVE CONFIGURATION
! ----------------------------------------------------------------------------
end
write memory
Line-by-Line Mechanics: What Is Happening Under the Hood?
Let's break down the critical commands and why each was chosen for production stability:
no ip domain-lookup- By default, typing a typo in Cisco IOS causes the switch to freeze for 30 seconds while broadcasting DNS queries to255.255.255.255. This command stops that annoying freeze instantly.logging synchronous- Automatically redraws your command prompt if an asynchronous system log (%SYS-5-CONFIG_I) pops up while you are mid-typing.crypto key generate rsa modulus 2048&ip ssh version 2- Generates a 2048-bit asymmetric key pair, satisfies modern OpenSSH ciphers, and disables legacy, vulnerable SSHv1 protocols.spanning-tree mode rapid-pvst- Replaces legacy 802.1D Spanning Tree with IEEE 802.1w Rapid Spanning Tree Protocol (RSTP) per VLAN.spanning-tree portfast default- Why this is critical for labs: Standard STP forces newly connected ports through 30 to 50 seconds of Listening and Learning states before forwarding traffic. By the time the port unblocks, Windows has already given up on its DHCP request and assigned itself an unusable APIPA address (169.254.x.x), or your PXE boot handshake has timed out. PortFast transitions edge ports toForwardingin under a second!spanning-tree portfast bpduguard default- If someone accidentally plugs a patch cable between two access ports, or connects a rogue switch emitting BPDUs, BPDU Guard immediately err-disables the port before a loop can form.switchport nonegotiate- Disables Dynamic Trunking Protocol (DTP) negotiation frames. Your servers and laptops will never form an 802.1Q trunk, so disabling DTP stops unnecessary broadcast noise.media-type rj45(onGi0/10) - Forces the PHY chip to bind strictly to the copper RJ-45 jack and ignore any empty SFP caddies.no ip routing- Ensures the 3560-CG behaves as a transparent Layer 2 switch during Day 1. The Zimaboard pfSense appliance continues to handle all default gateway and routing operations.ip default-gateway 10.1.1.1- Crucial for a Layer 2 switch! Without anip default-gatewaypointing to pfSense, the switch will successfully reply to devices on its local subnet (10.1.1.0/16), but will fail to return SSH packets to any remote IP (such as your laptop connecting over Tailscale from100.x.x.x).
Verification: Trust, but Verify
Once you've applied the configuration and recabled your hosts, verify physical link negotiation and Spanning Tree states from privileged EXEC mode (SW-CORE-01#):
1. The Port Status Check: show interfaces status
SW-CORE-01# show interfaces status
Output:
Port Name Status Vlan Duplex Speed Type
Gi0/1 LAB-HOST-ACCESS-PO connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/2 LAB-HOST-ACCESS-PO connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/3 LAB-HOST-ACCESS-PO connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/4 LAB-HOST-ACCESS-PO connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/5 LAB-HOST-ACCESS-PO connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/6 LAB-HOST-ACCESS-PO connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/7 LAB-HOST-ACCESS-PO connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/8 LAB-HOST-ACCESS-PO notconnect 1 auto auto 10/100/1000BaseTX
Gi0/9 UPLINK-TO-PFSENSE- connected 1 a-full a-1000 10/100/1000BaseTX
Gi0/10 LOCAL-ADMIN-LAPTOP connected 1 a-full a-1000 10/100/1000BaseTX
Notice that all server nodes, the pfSense uplink, and your laptop on Gi0/10 negotiate full 1000BaseTX full-duplex cleanly, while Gi0/8 remains in notconnect ready for bench testing.
2. Proving PortFast Is Active: show spanning-tree vlan 1
SW-CORE-01# show spanning-tree vlan 1
Output:
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi0/1 Desg FWD 4 128.1 P2p Edge
Gi0/2 Desg FWD 4 128.2 P2p Edge
Gi0/3 Desg FWD 4 128.3 P2p Edge
Gi0/4 Desg FWD 4 128.4 P2p Edge
Gi0/5 Desg FWD 4 128.5 P2p Edge
Gi0/6 Desg FWD 4 128.6 P2p Edge
Gi0/7 Desg FWD 4 128.7 P2p Edge
Gi0/9 Desg FWD 4 128.9 P2p
Gi0/10 Desg FWD 4 128.10 P2p Edge
(Notice the Edge designation next to all host ports: this proves that PortFast is operating properly and bypassing Spanning Tree listening/learning delays).
3. Management SVI & Remote Gateway Reachability
SW-CORE-01# ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
And finally, test remote SSH management from your admin laptop:
ssh dario@10.1.1.9
The Road Ahead
Swapping in the Cisco Catalyst 3560-CG gives us an enterprise-grade Layer 2 foundation. Everything that worked yesterday on the flat 10.1.1.0/16 subnet continues to work seamlessly with zero downtime—but we are no longer constrained by unmanaged plastic.
In upcoming posts, we will start leveraging the true power of this switch:
- 802.1Q VLAN Segmentation: Splitting the network into isolated security zones (Management, Active Directory, Endpoints, and DMZ).
- Layer 3 Switched Campus & Routed Access: Enabling
ip routing, moving SVIs directly to the 3560-CG, configuringip helper-addressfor cross-VLAN DHCP and PXE booting, and eliminating Spanning Tree spanning IDFs using routed access and OSPF.
Stay tuned, and happy labbing!