Disable secondary routing on core switches

To disable secondary routing on core switches, you can use no ip routing where supported, or convert all Layer 3 interfaces to switchports while keeping a management interface active.

Methods to Disable Routing

1. Using no ip routing Command On many Cisco Layer 3 switches, such as Catalyst 9500 series, you can disable IP routing with the no ip routing command if the switch does not need to perform Layer 3 functions for VLANs other than management . This effectively converts the switch to operate primarily at Layer 2, improving performance and reducing security risks. Note that some older platforms, like SUP720 in a Cat6509E, may not fully support persistent disabling of IP routing, and the command may revert after a reload . 2. Converting Interfaces to Switchports If no ip routing is not available or reliable, configure all physical interfaces as Layer 2 switchports and remove any Layer 3 SVIs except for a single management interface. This ensures no routing occurs while maintaining access for configuration changes via SSH or console . Example configuration:

interface range GigabitEthernet1/0/1 - 48 switchport no ip address

Keep one SVI for management:

interface Vlan1 ip address 192.168.1.2 255.255.255.0

3. Using Route-Maps and Prefix-Lists for Controlled Routing For core switches that participate in dynamic routing protocols like OSPF, you can control which routes are advertised by applying route-maps to redistributed connected interfaces. This allows selective routing without fully disabling Layer 3 functionality . 4. Automation and Scripts For platforms like Meraki, there is no direct “kill switch” for routing, but you can automate the removal and re-addition of SVIs or disable non-infrastructure ports to prevent lateral traffic spread during incidents . This approach preserves the configuration for recovery.

Best Practices

• Always maintain at least one management interface to access the switch remotely.
• Test changes in a lab environment before applying to production to avoid network outages.
• Document all changes and consider using scripts for reversible operations.
• For high-availability environments, coordinate with redundant core switches to prevent routing loops or traffic blackholing. By combining these methods, you can effectively disable secondary routing on core switches while maintaining Layer 2 connectivity and management access.