Using Telnet for remote administration of Cisco Routers and Switches (infact for any other device like a unix,linux or a solaris seerver) is not very secure as the data including the passwords are sent in clear text. It will only be a matter of time for a malicous attacker who can sniff the packets to gain access to the passwords and infact the whole network.
It is recommended that Secure Shell (SSH) is used for remote administration of Cisco Routers and Switches.
NOTE: Cisco IOS on the Catalyst switches are by default supplied with the SSH feature bultin. However, the basic Cisco IOS for the routers do not have the SSH facility built-in. To use the SSH feature on Cisco Routers, you need to have the Cisco IOS version with the IPSec(DES or 3DES) encryption software.
In this article, we will examine how to enable and configure SSH (Secure Shell) on a Cisco Router with Cisco Packet Tracer. If you don't already have the Remote - SSH extension installed, you can search for 'remote ssh' in the Extensions view (Ctrl + Shift + X).
To see if SSH is already enabled
Router# show ip ssh
%SSH has not been enabled
To enable SSH on your Cisco Switch or Router, do the following from the global configuration mode:
Configure the Hostname on the Switch or Router
Router(config)# hostname MyRouter
Configure the Domain name for the Cisco Switch or Router
MyRouter(config)# ip domain-name MyDomain
Generate a RSA Key Pair
MyRouter(config)# crypto key generate rsa
This enables SSH on the Cisco switch or the router.
Ssh Into Docker Container
The following optional commands are recommended but are not mandatory:
Set the SSH Negotiation phase timeout interval (in seconds)
MyRouter(config)# ip ssh time-out 120
This sets the time period for the Cisco Router or Switch to wait for 120 seconds before timing out the client during the SSH Negotiation phase.
Set the Maximum retry attempts
MyRouter(config)# ip ssh authetication-retries 3
Ssh Inet6
This sets the maximum number of the Authentication retires to be 3 times before the interface (vty) is reset.
To change the default port for SSH (default is 22) connection
MyRouter(config)# ip ssh port 3536
This sets the port number to listen for SSH connections to be 3536.
Try to logon and logoff the Cisco IOS Router or switch to ensure it works OK and then disable Telnet access to the switch. This can be done by making SSH as the only transport agent.
MyRouter(config)# line vty 0 4
MyRouter(config)# transport input ssh
This makes SSH as the only way to connect to the Cisco Routers or Switches remotely.
Write the config changes to the startup-config:
MyRouter# wr mem
To see the status of the SSH on the Cisco switch or the router
MyRouter# show ip ssh
SSH Enabled – version 1.5
Authentication timeout: 120 secs; Authentication retries: 3
To view the status of SSH connections
MyRouter# show ssh
Connection Version Encryption State Username
0 1.5 3DES Session Started guest
If at any time, you want to disable SSH on the Cisco Router or Switch, from the Global Configuration
MyRouter(config)# crypto key zeroize rsa
Ssh In Powershell
This deletes the RSA key-pair. Once you delete the RSA key-pair, it disables the SSH server.
In this case, if you had ssh as the only transport mode then this needs to be changed to default
Ssh Into Kubernetes Pod
MyRouter(config)# line vty 0 4
MyRouter(config)# transport input telnet
Ssh Into Ubuntu Server
If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!