CCNA online course

Using Telnet on Cisco IOS Devices

Learn how to start, suspend, resume, and close Telnet sessions in Cisco IOS, configure VTY lines for incoming access, troubleshoot connections, and understand Telnet security limits.

Telnet is an application-layer remote-access protocol. It lets a Telnet client connect to a Telnet server and interact with the server's command-line interface (CLI). Cisco IOS can operate as both a Telnet client, which initiates connections, and a Telnet server, which accepts incoming connections.

Telnet sends session traffic, including credentials, without encryption. It is therefore mainly suitable for labs, legacy environments, or tightly controlled networks. Use SSH (Secure Shell) for encrypted production management.

Telnet Client and Server Roles

A Telnet client is the software that starts a connection. A Telnet server is the service on the remote device that accepts the connection and provides CLI access.

• The client initiates a session to a destination IPv4 address.
• The server presents a login prompt when its remote-access configuration permits it.
• After authentication, commands entered through the session execute on the remote device.

For example, when router R2 connects to router R1, R2 is acting as the Telnet client and R1 is acting as the Telnet server.

Starting an Outbound Telnet Session

To start an outbound Telnet connection from Cisco IOS, enter the command from privileged EXEC mode. This mode commonly uses a prompt ending in #.

R2# telnet IP_ADDRESS

Replace IP_ADDRESS with the reachable management address of the remote IOS device.

Example: Connecting from R2 to R1

Assume R1 has a management address of 192.0.2.1 and R2 can reach it.

R2# telnet 192.0.2.1
Trying 192.0.2.1 ... Open

User Access Verification

Password:
R1>

The prompt changed from R2# to R1>. This is an important operational clue: commands now run on R1, not R2. For example, a harmless command such as show version displays information about R1 while the Telnet session is active.

R1> show version

Managing an Active Telnet Session

An active Telnet session can be suspended or closed. Suspending preserves the connection while returning you temporarily to the local IOS CLI. Closing ends the remote session.

Suspend and Resume Example

While connected to R1 from R2, use the IOS escape sequence:

R1> Ctrl+Shift+6, then X

The local R2 prompt appears again. The connection to R1 has not been closed. To return to it, press Enter twice:

R2#
R2#
R1>

By contrast, entering exit from the remote session closes that session. Use suspension when you need to move temporarily to the local device; use exit when the remote work is complete.

Configuring Cisco IOS as a Telnet Server

Incoming remote terminal access is controlled through VTY lines. A VTY line is a logical terminal line used for a remote-management session. It is not a physical interface.

Many Cisco IOS devices provide VTY lines numbered from 0 through 15. The standard range contains 16 logical lines, so it can represent up to 16 simultaneous remote terminal sessions when all lines are available and permitted for the relevant protocols.

Configure Password-Based VTY Access

Enter global configuration mode, select the VTY lines, set a password, and enable password checking with login.

R1# configure terminal
R1(config)# line vty 0 15
R1(config-line)# password PASSWORD
R1(config-line)# login
R1(config-line)# end

Replace PASSWORD with the password required for the lab or controlled network. The login command tells IOS to request the configured VTY password when a remote user connects.

After this configuration, test from a second reachable device. The connecting device should reach R1 and receive a password prompt. Successful authentication should then provide the R1 CLI.

VTY Lines and Concurrent Sessions

A concurrent session is one of multiple remote-management connections that exist at the same time. With the range 0 15, the line numbers are:

0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15

Because counting starts at zero, the number of lines is calculated as 15 - 0 + 1 = 16. These logical lines can be used by remote terminal sessions such as Telnet or SSH, subject to the device's configuration and available resources.

Verification and Operational Awareness

Verify Reachability and Login

• Confirm that the destination IPv4 address is correct.
• Confirm that the client has IP reachability to the target device.
• Confirm that the target interface and path are operational.
• Start Telnet and verify that a login prompt is presented.
• After authentication, inspect the hostname in the prompt to confirm the active device.

A prompt change is useful evidence that the session is connected, but it should not replace basic reachability and authentication checks.

Use IOS Operational and Diagnostic Information

When investigating remote-access behavior, IOS operational visibility and debugging concepts can provide supporting information. For example:

show processes
debug

show processes provides running-process visibility. The debug command represents IOS debugging facilities that can reveal detailed events related to operations. Debug output can consume CPU and produce substantial console output, so use debugging carefully and avoid enabling unnecessary debugging on production devices. Disable any enabled debugging when the investigation is complete according to the device's supported IOS procedures.

Troubleshooting Telnet

The Telnet Connection Cannot Be Established

• Confirm IP reachability between the client and target device.
• Check that the destination address in telnet IP_ADDRESS is correct.
• Confirm that the target interface is operational.
• Check the path between the devices for a routing or connectivity problem.

The Device Is Reached but Login Is Rejected

• Confirm that the intended VTY lines were selected.
• Confirm that a password was configured on those lines.
• Confirm that the login command is present.
• Retest from a second reachable device after correcting the VTY configuration.

Commands Run on the Wrong Device

• Inspect the current prompt and identify the hostname.
• Determine whether a Telnet session is still active.
• Determine whether the session was suspended and is awaiting resumption.
• Use Ctrl+Shift+6, then X, to return to the local CLI when necessary.
• Before changing configuration, verify whether you are in local or remote context.

A Suspended Session Cannot Be Resumed

Press Enter twice to return to the suspended session. This works only if the original connection was suspended. If exit was used, the session was terminated and must be started again with the telnet command.

Telnet Security Limitations

Telnet's lack of encryption means that a network observer may be able to read commands and credentials. Do not treat a VTY password as a replacement for encryption. For production administration, configure and use SSH instead.

Key Terms

• Telnet: A remote terminal application protocol for accessing another device's CLI.
• Cisco IOS: Cisco's network-device operating system, including Telnet client and server capabilities.
• Privileged EXEC mode: IOS operational mode commonly identified by a # prompt.
• Global configuration mode: The configuration context used to select and configure device features, including VTY lines.
• Line configuration mode: The context used to configure options for selected console, auxiliary, or VTY lines.
• Escape sequence: A special key sequence that suspends an active Telnet connection without ending it.
• SSH: Secure Shell, an encrypted remote-access protocol generally preferred over Telnet.

Related Cisco IOS Concepts

For prerequisite and follow-up study, review Configuring Passwords in IOS, Computer Networks Explained, and the OSI Reference Model.