A VTY line is a virtual terminal line used for remote CLI access to a Cisco IOS router or switch through Telnet or SSH. The command line vty 0 15 selects all 16 lines for configuration, allowing up to 16 simultaneous remote users. section 5.2.2 section 5.4
Configure VTY lines to control authentication, session behavior, protocols, and source hosts:
- Use login or login local to require authentication; login local uses a locally configured user account. section 5.2.2 section 5.4
- Use exec-timeout minutes to disconnect inactive sessions; the example changes the timeout to 20 minutes. section 5.3.2
- Use transport input telnet or transport input ssh to restrict the protocol accepted on the lines. section 5.3.2 section 5.4
- Apply an ACL with access-class acl in to restrict which source hosts can connect to the VTY lines. section 5.2.2 section 5.4
- Configure all lines consistently with line vty 0 15; running configurations may display them as groups 0–4 and 5–15 for backward compatibility. section 5.3.2 section 5.4
SSH-only VTY configuration
SW1(config)# line vty 0 15 SW1(config-line)# login local SW1(config-line)# exec-timeout 20 SW1(config-line)# transport input ssh SW1(config-line)# access-class 1 in This requires a local user account, ends sessions after 20 minutes of inactivity, permits only SSH, and applies ACL 1 to incoming VTY connections.
