liveBook · Manning

Crypto key generate rsa

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

crypto key generate rsa is a Cisco IOS global configuration command that creates an RSA key pair for SSH.

crypto key generate rsa is a Cisco IOS global-configuration command that creates the RSA key pair required to enable SSH on a router or switch. SSH uses the keys to encrypt remote CLI communications. section 5.3.1 section 5.4

Configure and interpret the command as follows:

  • Configure a hostname other than the default Router and an IP domain name before generating an automatically named key pair; IOS uses the device FQDN as the key name. section 5.3.1
  • Run crypto key generate rsa in global configuration mode, then accept or enter the modulus size when IOS prompts; larger modulus sizes provide stronger encryption. section 5.3.1
  • Use crypto key generate rsa label name to choose a key-pair name without an FQDN or to create multiple uniquely named pairs. section 5.3.1
  • Use crypto key generate rsa modulus size to supply the modulus directly; Cisco recommends at least 2,048 bits, and newer software may reject smaller SSH keys. section 5.4
  • Verify the result with show ip ssh; successful generation should report SSH Enabled, commonly as version 1.99. section 5.3.1 section 5.4

Generate an FQDN-named key pair

SW1(config)# ip domain name jeremysitlab.com SW1(config)# crypto key generate rsa The name for the keys will be: SW1.jeremysitlab.com How many bits in the modulus [512]: 4096 % Generating 4096 bit RSA keys, keys will be non-exportable... [OK] SW1# show ip ssh SSH Enabled - version 1.99 section 5.3.1

SW1(config)# ip domain name jeremysitlab.com                       #1
SW1(config)# crypto key generate rsa                               #2
The name for the keys will be: SW1.jeremysitlab.com                #3
Choose the size of the key modulus in the range of 360 to 4096 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.
How many bits in the modulus [512]: 4096                           #4
% Generating 4096 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 7 seconds)
*Sep 10 04:05:47.397: %SSH-5-ENABLED: SSH 1.99 has been enabled    #5
#1 Configures a domain name
#2 Generates an RSA key pair
#3 The keys are named using the FQDN.
#4 Larger modulus sizes are more secure.
#5 A log message indicates that SSH version 1.99 is enabled.

Inspect the complete Cisco IOS interaction, including the domain-name prerequisite, FQDN-derived key name, modulus prompt, generation result, and SSH enablement message. section 5.3.1

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes
Explains prerequisites, naming options, modulus sizing, command variants, generation output, and verification, stopping short of RSA algorithm internals.
Examples
Uses Cisco IOS command transcripts showing missing prerequisites, FQDN-based naming, 4,096-bit generation, and show ip ssh verification.
What it assumes
Assumes Cisco IOS global-configuration access and teaches the hostname and domain-name requirements from the command errors.
What you can do after
Configure an RSA key pair and verify that SSH becomes enabled with show ip ssh.
How it connects
Connects RSA keys with SSH, hostname, domain name, FQDN, modulus size, and SSHv2.
Cover of Acing the CCNA Exam: Volume 2 Advanced Networking and Security
liveBookmanning.com
Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.