CCNA online course

Accessing Cisco IOS Devices

Learn how to access, configure, secure, and verify Cisco IOS routers and switches using console, SSH, VTY, AUX, and privileged EXEC access.

Cisco IOS is the operating system and command-line environment used on many Cisco routers and switches. Administrators use the Cisco IOS CLI to configure interfaces, assign management addresses, secure access, inspect device status, and save configuration changes.

Device access can be local or remote. Local access uses a physical console connection. Remote access travels across a network, usually with SSH. Initial setup normally requires console access because the device may not yet have an IP address, active interface, routing information, local credentials, or SSH keys.

1. Cisco IOS Access Methods

Management access is separate from the forwarding of ordinary user traffic. Out-of-band management uses a path independent of the normal production network, such as the console port. In-band management uses the operational network, such as SSH to a management IP address.

2. Cisco IOS CLI Fundamentals

Prompts and hostnames

The CLI prompt identifies the device hostname and often shows the current command mode. A default hostname may appear as Router or Switch. After setting a hostname, the prompt changes accordingly.

Moving between modes

R1> enable
R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# exit
R1(config)# line vty 0 15
R1(config-line)# end
R1# disable
R1>

exit moves back one level. For example, it moves from interface configuration to global configuration. end returns directly to privileged EXEC mode from a configuration submode. The keyboard shortcut Ctrl+Z commonly performs the same return to privileged EXEC mode.

Help, completion, and command history

• Enter ? to display commands or keywords available in the current context.
• Enter show ? to see valid show command options.
• Press Tab to complete an unambiguous command or keyword.
• Use the Up and Down arrow keys, or the command-history controls supported by the terminal, to reuse earlier commands.
• Many commands can be abbreviated when the abbreviation is unique. For example, conf t commonly means configure terminal. Full commands are clearer in documentation and exams.
• Context-sensitive help is based on the current mode and the text already entered. If a command is rejected, check both spelling and mode.

3. Physical Console Access

The console port is a physical local management port. It provides out-of-band access, so it can work even when the device has no configured IP address or when the production network is unavailable.

A typical console connection requires an administrator workstation, a compatible console cable or USB console connection, and terminal-emulation software. Exact connectors vary by platform: a device may use an RJ-45-style console port, a mini-USB console port, or a USB console port.

These settings are commonly called 9600 8N1. After connecting, open the terminal session, power on or reboot the device if appropriate, and press Enter. The device performs hardware initialization and loads IOS. After boot messages finish, the CLI prompt appears. If no startup configuration exists, IOS may present an initial configuration dialog; it can be completed or exited according to the lab objective.

Console access is also important for password recovery because it can provide access when remote credentials or network connectivity are unavailable. Password recovery is platform- and procedure-specific; protect physical console access because it can bypass ordinary network reachability controls.

Terminal-emulation software

A terminal emulator provides the window that sends and receives characters over the console connection. Common choices include PuTTY, Tera Term, SecureCRT, and platform-native serial terminal applications. Select the workstation's actual serial or USB serial interface, not an unrelated network adapter, and apply the device's serial settings.

Save a session profile after testing it. A useful profile records the selected serial interface, speed, framing, flow control, terminal dimensions, and logging preferences. Reusing a verified profile reduces setup errors during repeated administration.

4. Console, AUX, VTY, and Management Interfaces

In addition to the console, some Cisco platforms provide an AUX port. AUX is an optional asynchronous management port historically used with modems for remote out-of-band administration. It differs from a console connection because it was designed for an attached asynchronous device, but both are managed with line configuration. Hardware availability varies, so do not assume every router or switch has an AUX port.

VTY lines are virtual terminal lines. They accept inbound remote CLI sessions such as SSH and Telnet. They do not represent physical ports. A device can support multiple simultaneous sessions according to its available VTY lines and platform limits.

A dedicated management Ethernet interface, where present, provides a separate physical path for management traffic. Otherwise, a router interface or a Layer 2 switch SVI can provide the reachable management address.

5. Basic Identity and Management Connectivity

Set a hostname and enable secret

A hostname makes prompts and logs identifiable. An enable secret protects entry into privileged EXEC mode and is preferred over the legacy enable password.

enable
configure terminal
hostname R1
enable secret Use-a-strong-unique-secret
end

Configure a router interface

On a router, assign an IPv4 address to a management-capable routed interface and enable it when necessary. An administratively shut interface does not forward traffic until enabled.

configure terminal
interface GigabitEthernet0/0
 ip address 192.0.2.1 255.255.255.0
 no shutdown
end
show ip interface brief

Configure a Layer 2 switch SVI

An SVI, or switched virtual interface, is a logical interface associated with a VLAN. It provides an IP management address for a Layer 2 switch. The SVI and its VLAN must be operational, and the switch needs a default gateway to reach management hosts outside its local subnet.

configure terminal
interface vlan 1
 ip address 192.0.2.10 255.255.255.0
 no shutdown
exit
ip default-gateway 192.0.2.1
end
show ip interface brief

In production, administrators commonly use a dedicated management VLAN instead of VLAN 1. Verify that an active access port or trunk carries the management VLAN. A switch SVI can remain down if its VLAN has no active member port or is not carried correctly.

6. Securing Console and Privileged Access

Protect the console line

A line password is used only when the line is configured to request it with login. The following configuration protects console access, disconnects an idle session after five minutes, and keeps system messages from disrupting command entry.

configure terminal
line console 0
 password Console-line-secret
 login
 exec-timeout 5 0
 logging synchronous
end

Named local accounts are preferable when individual identity is needed. Create them with username ... secret, then use login local on the relevant line. The local user database is the device's locally configured collection of usernames and protected secrets.

configure terminal
username admin privilege 15 secret Strong-unique-admin-secret
line console 0
 login local
 exec-timeout 5 0
end

service password-encryption can obscure some plain-text line passwords in the configuration, but it is not strong encryption and is not a substitute for strong secrets, named authentication, SSH, or AAA. Use unique credentials and restrict physical access.

Display a warning banner

A message-of-the-day banner can communicate an authorized-use warning. Choose wording appropriate for the organization's policy and legal requirements.

configure terminal
banner motd #Authorized access only. Disconnect if you are not permitted.#
end

7. Remote Access: Telnet and SSH

Telnet provides remote terminal access but sends credentials and session traffic in clear text. Anyone able to capture the traffic may read the session. Telnet should not be used for normal production management.

SSH, or Secure Shell, encrypts remote terminal traffic and is the preferred method. Remote access requires more than a VTY command: the device must have a reachable management IP address, an active interface or SVI, appropriate routing or a default gateway, authentication credentials, and correctly configured VTY lines.

8. Configure SSH Access

IOS SSH server setup depends on several related elements. The device needs a hostname and IP domain name before RSA keys are generated. It also needs a local account, SSH version selection, and VTY lines that use the local database and permit SSH.

enable
configure terminal
hostname R1
ip domain-name example.net
username admin privilege 15 secret Strong-unique-admin-secret
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 15
 login local
 transport input ssh
 exec-timeout 10 0
end

The RSA key pair identifies the SSH server cryptographically. The management IP makes the device reachable. The local username and secret authenticate the administrator. VTY settings determine how inbound sessions authenticate and which protocols they may use. All four areas must agree for a successful login.

From an administrator workstation, test the path with an SSH client, using the device's reachable address:

ssh admin@192.0.2.1

On some IOS releases, the RSA command prompts for a modulus size instead of accepting it on the same line. Follow the device prompt and choose a size supported by the platform; 2048 bits is a common baseline for this example.

9. VTY Line Management

VTY lines represent the device's available inbound virtual terminal sessions. A configuration such as line vty 0 15 selects a range, but syntax and the number of lines vary by platform and IOS release. Configure every relevant range; changing only the first few lines may leave other lines permitting Telnet or using different authentication.

configure terminal
line vty 0 15
 login local
 transport input ssh
 exec-timeout 10 0
end

• login local uses the local user database.
• transport input ssh permits SSH and excludes Telnet on those lines.
• exec-timeout 10 0 disconnects an inactive session after ten minutes and zero seconds.
• The number of concurrent inbound sessions is limited by available VTY lines and platform resources.

10. Safe Configuration and Verification Workflow

1. Connect through the console and confirm the prompt.
2. Set the hostname and privileged access protection.
3. Configure and enable the router interface or switch SVI.
4. Configure the switch default gateway or the required router route.
5. Create a local administrator account and configure SSH.
6. Inspect the configuration and interface state.
7. Keep the console session open while testing SSH from a separate workstation.
8. After successful tests, save the configuration.

running-config is the active configuration in memory. It affects the device now but is lost after a reload unless saved. startup-config is the saved configuration used during startup.

show running-config
show running-config | section line
show ip interface brief
show ip ssh
show users
ping 192.0.2.1
copy running-config startup-config

Always verify a working remote login before ending the console session. This prevents a configuration mistake from causing an accidental lockout. For password-related IOS configuration, see Configure Passwords in IOS.

11. Access-Control Hardening

Management-plane security controls who can administer the device. It is distinct from data-plane filtering, which controls ordinary traffic traversing router interfaces. A data-plane ACL does not automatically restrict VTY logins.

• Use SSH instead of Telnet and disable insecure remote services when they are not required.
• Use strong, unique secrets and named accounts. Apply least privilege rather than giving every account unnecessary administrative rights.
• Place management addresses on a dedicated management interface or management VLAN when appropriate.
• Restrict VTY access to authorized source networks with a standard ACL and access-class.

configure terminal
access-list 10 permit 192.0.2.0 0.0.0.255
line vty 0 15
 access-class 10 in
 transport input ssh
 login local
end

This example permits VTY connections whose source addresses are in 192.0.2.0/24. An implicit deny at the end of the ACL blocks other sources. Apply and test such a restriction carefully while retaining console access.

12. Troubleshooting Access Problems

No text appears in the console terminal

• Confirm the device is powered on and has completed booting.
• Check the console cable, USB adapter, and physical connection.
• Select the correct workstation serial or USB serial interface.
• Use 9600 bps, 8 data bits, no parity, 1 stop bit, and no flow control.
• Press Enter to request a prompt.

A switch management address cannot be pinged

• Run show ip interface brief and check whether the SVI is up and up.
• Confirm the management VLAN has an active member port and is carried across required trunks.
• Check the address, mask, workstation settings, and switch default gateway.
• Test local-subnet and next-hop reachability before testing a remote subnet.

SSH times out or is refused

• Ping the management address first.
• Run show ip ssh and verify that SSH is active.
• Check that hostname and domain name were configured before RSA key generation.
• Inspect every VTY line range for transport input ssh.
• Check for a VTY access-class that blocks the administrator's source address.

SSH reaches the device but authentication fails

• Verify the username and secret.
• Confirm the VTY lines use login local, not only a line password.
• Check whether AAA configuration changes the expected authentication method.
• Review the local account configuration from the console.

Telnet still works

• Inspect all VTY ranges, not just the first range.
• Replace permissive settings with transport input ssh on each relevant range.
• Retest both Telnet and SSH from an authorized workstation.

Changes disappear after reload

The running configuration was probably not saved. Compare show running-config with show startup-config, then use:

copy running-config startup-config

13. Exam-Relevant Notes

• The > prompt indicates user EXEC mode; the # prompt indicates privileged EXEC mode.
• enable secret is preferred over enable password.
• Console access is normally required for initial setup because remote management prerequisites do not yet exist.
• Telnet is clear text; SSH is encrypted and preferred.
• A Layer 2 switch uses an SVI for an IP management address and normally needs ip default-gateway to reach other networks.
• A router's management interface must have an address and be operational; use no shutdown when it is administratively down.
• SSH requires reachability, local authentication or another authentication method, VTY configuration, and RSA keys.
• running-config is active memory; startup-config is the saved boot configuration.
• access-class restricts inbound VTY sessions; it is not the same as an interface ACL filtering transit traffic.

For broader device configuration practice, review Configure NTP on a Cisco Device and Configure OSPF.