CCNA Security online course

How to Enable SSH on a Cisco Router

Learn how to configure SSH-only remote management on a Cisco IOS router with a hostname, domain name, RSA keys, local user account, and VTY lines.

SSH, or Secure Shell, provides encrypted remote command-line access to a network device. On a Cisco IOS router, SSH protects administrative credentials and session traffic while you manage the device remotely.

Telnet is a legacy remote terminal protocol. It sends credentials and session data without encryption, so someone able to observe the management traffic may read usernames, passwords, and commands. SSH is the preferred protocol for remote Cisco IOS administration.

Prerequisites

Before configuring SSH, confirm the following:

  • The router has a reachable management IP address.
  • The management interface is active and has working IP connectivity to the administrator's workstation.
  • You can use Cisco IOS command modes, including privileged EXEC mode, global configuration mode, and VTY line configuration mode.
  • The router has a unique hostname.
  • An IP domain name is configured. IOS combines the hostname and domain name to identify the RSA keys.
  • The IOS image and platform support SSH and RSA key generation.

For example, the workstation in this lesson connects to the router management address 10.0.0.20.

SSH Configuration Steps and Purpose

Set hostname — Global configuration mode — Gives the device an identity and changes the IOS prompt.

Set domain name — Global configuration mode — Supplies the domain portion of the RSA key identity.

Generate RSA keys — Global configuration mode — Creates the public and private keys required by the SSH server.

Create local user — Global configuration mode — Adds credentials to the local IOS user database.

Configure VTY authentication — line vty configuration mode — Makes VTY sessions authenticate against the local user database.

Allow SSH only — VTY line configuration mode — Accepts SSH and excludes Telnet on the selected VTY lines.

Test remote access — SSH-capable client — Confirms reachability, authentication, and access to the router.

1. Set the Router Hostname

A hostname is the configured device name. IOS displays it in the command prompt, making it easier to identify which router is being configured. The hostname also contributes to the identity assigned to generated RSA keys.

Router> enable
Router# configure terminal
Router(config)# hostname RTR1
RTR1(config)#

After the command runs, the prompt changes from Router to RTR1. Choose a unique, meaningful name for each device.

2. Configure an IP Domain Name

An IP domain name is a domain suffix configured on the router. IOS uses the hostname and domain name together when naming the RSA key pair. Configure it before generating the keys.

RTR1(config)# ip domain-name mydomain.local

In this example, the router's hostname is RTR1 and its domain name is mydomain.local. Together, they provide the identity used during RSA key generation.

3. Generate RSA Keys

RSA keys are a public and private cryptographic key pair. The SSH server on the router uses these keys to establish encrypted sessions. Successful key generation is required before the router can accept inbound SSH connections.

RTR1(config)# crypto key generate rsa

IOS may prompt for an RSA modulus. The RSA modulus is the key-size value. Select the size required by your IOS release and security policy. Larger key sizes generally provide stronger cryptographic protection but can take longer to generate and require more processing.

How many bits in the modulus [512]: 1024

The exact prompt and available sizes vary by IOS platform and software release. Wait for key generation to finish before testing SSH.

4. Create a Local SSH User Account

The local user database stores usernames and authentication information configured directly on the router. Create an account for remote management with the secret form of the command.

RTR1(config)# username sshuser secret secretpass

A secret is the Cisco IOS password configuration form intended to avoid storing the password as clear text in the configuration. The account created here will be used when the VTY lines authenticate users locally.

Use a strong, unique password in a real deployment. The example password is provided only to make the lab configuration understandable.

5. Configure VTY Lines for Local Login

VTY lines, or virtual terminal lines, control inbound remote-management sessions such as Telnet and SSH. Select the standard VTY range and tell IOS to use the local user database.

RTR1(config)# line vty 0 15
RTR1(config-line)# login local

login local enables username-based authentication against locally configured accounts. Without it, the router will not use sshuser from the local database for these VTY sessions.

6. Permit SSH and Exclude Telnet

Use transport input ssh under the selected VTY lines. This setting permits inbound SSH and excludes other configured remote transport protocols, including Telnet.

RTR1(config-line)# transport input ssh
RTR1(config-line)# end
RTR1#

The complete basic configuration is:

enable
configure terminal
hostname RTR1
ip domain-name mydomain.local
crypto key generate rsa
username sshuser secret secretpass
line vty 0 15
login local
transport input ssh
end

Telnet and SSH Remote Management Comparison

Traffic protection — Telnet: Session data is sent in readable form. — SSH: Session traffic is encrypted.

Credential protection — Telnet: Credentials are not protected in transit. — SSH: Credentials are exchanged through an encrypted session.

Recommended management use — Telnet: Avoid for administrative access. — SSH: Preferred for remote Cisco IOS management.

7. Connect to the Router with an SSH Client

From a management workstation, use an SSH-capable client such as PuTTY. Enter the router's management address, 10.0.0.20, select SSH, and start the connection.

Host: 10.0.0.20
Protocol: SSH
Username: sshuser
Password: secretpass

After the client reaches the router and the credentials are accepted, the session should end at the router's user EXEC prompt:

RTR1>

The > prompt indicates user EXEC mode. Use enable separately if privileged EXEC access is required and configured.

Verification

Verify the configuration from the router console or an existing administrative session. Useful checks include:

  • Confirm the hostname in the prompt.
  • Confirm that the management interface has the expected IP address and is operational.
  • Confirm that RSA keys exist after key generation.
  • Confirm that the local username is present.
  • Confirm that login local and transport input ssh appear under the intended VTY lines.
  • Connect with an SSH client and verify that the session reaches the router user EXEC prompt.
RTR1# show ip interface brief
RTR1# show crypto key mypubkey rsa
RTR1# show running-config | section line vty

Troubleshooting

RSA key generation cannot proceed or SSH is unavailable

The hostname or IP domain name may be missing. Configure both values in global configuration mode, then run crypto key generate rsa again.

The SSH client cannot reach the router

Check the management IP address, interface state, routing path, and physical or logical connectivity. Verify the router interface address and operational status, then test IP reachability from the client.

SSH connects but the remote login is rejected

The local username may be missing, the secret may be incorrect, or the VTY lines may not contain login local. Verify the username and secret and inspect the VTY configuration.

Telnet still works

The VTY transport setting may still permit Telnet, or transport input ssh may have been applied to only part of the VTY range. Apply it to the required VTY lines.

The login prompt appears but the expected account fails

Ensure the SSH client is sending the locally configured username, sshuser, and its associated secret. Check for typing errors and verify that the account was configured in global configuration mode.

Key Terms

  • SSH: Secure Shell, an encrypted protocol for remote command-line access.
  • Telnet: A legacy remote terminal protocol that does not protect transmitted credentials or session data.
  • Cisco IOS: The operating system and command-line environment used by many Cisco routers and switches.
  • VTY lines: Virtual terminal lines governing inbound remote-management sessions.
  • RSA keys: Public and private cryptographic keys generated on the device for SSH operation.
  • RSA modulus: The key-size value selected during RSA key generation.
  • Hostname: The configured device name shown in the IOS prompt and used in the SSH key identity.
  • IP domain name: The domain suffix used with the hostname during RSA key generation.
  • Local user database: The IOS database containing locally configured usernames and secrets.
  • login local: A VTY setting that authenticates users against the local user database.
  • transport input ssh: A VTY setting that permits inbound SSH and excludes other configured remote transports.
  • secret: A Cisco IOS password configuration form intended to avoid clear-text password storage.

Next Steps

For broader management-plane protection, review protecting the management plane. To use centralized authentication instead of only the local user database, study AAA authentication and authorization. For local password configuration details, see passwords on Cisco IOS devices.