SSH provides encrypted remote CLI access to Cisco routers and switches over an IP network. Unlike Telnet, it protects communications from interception and supports remote configuration, verification, and troubleshooting. section 5.0 section 5.3
Configure SSH on Cisco IOS by completing these core steps:
- Generate an RSA key pair; a modulus of at least 768 bits is required for SSHv2. section 5.3 section 5.3.2
- Create a local username and enable secret so users can authenticate and enter privileged EXEC mode. section 5.3.2
- Configure the VTY lines with login local and transport input ssh; use line vty 0 15 to configure all 16 lines. section 5.3.2 section 5.4
- Prefer ip ssh version 2, apply an inbound access-class, and set exec-timeout to limit exposure and inactive sessions. section 5.3.2
Connect to a switch
From a host, run ssh -l jeremy 10.0.0.2, enter the account password, and reach the SW1> prompt. Cisco IOS can also initiate the connection with the same -l form; the username@address form is not supported by Cisco IOS. section 5.3.2
SW1(config)# enable secret cisco #1 SW1(config)# username jeremy secret ccna #1 SW1(config)# access-list 1 permit 192.168.1.0 0.0.0.255 #2 SW1(config)# ip ssh version 2 #3 SW1(config)# line vty 0 15 #4 SW1(config-line)# login local #5 SW1(config-line)# exec-timeout 20 #6 SW1(config-line)# transport input ssh #7 SW1(config-line)# access-class 1 in #8 #1 Configures an enable secret and user account #2 Creates an ACL to limit access to the VTY lines #3 Limits connections to SSH version 2 only #4 Configures all 16 VTY lines #5 Requires users to log in with a user account #6 Logs out users after 20 minutes of inactivity #7 Allows only SSH connections #8 Applies the ACL
Use the annotated configuration as a compact reference for local authentication, SSHv2-only access, VTY selection, timeout control, SSH-only transport, and source filtering. section 5.3.2
