VMware ESXi and vSphere Cluster Management

Configure Console, VTY, Enable, and Enable Secret Passwords on Cisco IOS

Learn how to configure, verify, test, and save Cisco IOS console, VTY, enable, and enable secret passwords, with security guidance and troubleshooting.

Cisco IOS is the network operating system and command-line environment used on many Cisco routers and switches. Access passwords help restrict who can reach the device CLI and who can enter privileged EXEC mode, where configuration changes are possible.

This lesson covers four basic password types: the console password, VTY password, enable password, and enable secret. These controls are useful in a lab and provide basic protection, although production networks commonly use local usernames, AAA, and centralized authentication.

What IOS Access Passwords Protect

A Cisco IOS device separates command access into levels. A user may first authenticate to the device CLI through a console or VTY line. From user EXEC mode, the enable command requests a privileged-mode credential. Privileged EXEC mode can lead to global configuration mode, where device-wide settings can be changed.

Console password: Protects direct local access through the physical console connection.
VTY password: Protects virtual terminal lines used by remote management sessions such as Telnet or SSH.
Enable password: A legacy password requested when entering privileged EXEC mode.
Enable secret: The preferred basic password for privileged EXEC mode. It takes precedence over an enable password when both are configured.

Password type	Configured location or command context	What access it controls	Authentication trigger	Configuration storage/security characteristic	Key recommendation
Console password	`line console 0`	Direct local console access	Opening a console session when `login` is enabled	Line password; may be obfuscated by `service password-encryption`	Use it, but preserve console recovery access
VTY password	`line vty` range	Remote virtual terminal access	Starting a Telnet or SSH session when line login applies	Line password; obfuscation is not network encryption	Prefer SSH and stronger authentication methods
Enable password	Global configuration mode	Entry to privileged EXEC mode	Entering `enable`	Legacy value with weaker visibility protection than an enable secret	Use only for compatibility or controlled lab demonstrations
Enable secret	Global configuration mode	Entry to privileged EXEC mode	Entering `enable`	Stored as a password hash rather than an ordinary clear-text value	Prefer it over `enable password`

IOS Command Modes for Password Configuration

An IOS prompt indicates the current command mode. The exact hostname varies, but the ending of the prompt identifies the mode.

Mode	Typical prompt	How it is entered	Relevant password tasks
User EXEC	`Router>`	Initial mode after connecting	Run basic monitoring commands and enter `enable`
Privileged EXEC	`Router#`	Use `enable` from user EXEC	Run configuration and verification commands
Global configuration	`Router(config)#`	Use `configure terminal` from privileged EXEC	Configure enable passwords and enter line contexts
Console line configuration	`Router(config-line)#`	Use `line console 0`	Configure the console line password and `login`
VTY line configuration	`Router(config-line)#`	Use `line vty` with a supported range	Configure remote line passwords and login behavior

Use end or press Ctrl-Z to return directly to privileged EXEC mode. Use exit to move back one configuration level.

Configure a Console Password

The console line is the physical local-management line, normally identified as line console 0. The password command defines a line password, while login tells IOS to request that password when the line is used.

Router> enable
Router# configure terminal
Router(config)# line console 0
Router(config-line)# password <CONSOLE_PASSWORD>
Router(config-line)# login
Router(config-line)# end
Router#

Replace <CONSOLE_PASSWORD> with a unique lab value. Do not place a real production credential in documentation, screenshots, or training examples.

Test console authentication safely

Keep the current administrative session open until the new settings are confirmed.
Use a second console session, if the platform and terminal setup support it, or disconnect and reconnect only when you have a recovery plan.
Confirm that IOS requests the console password.
Enter the test credential and verify that the session reaches user EXEC mode.
Enter enable and test the privileged credential separately.

Never test a new remote-access configuration by closing the only working session first. Console access is the normal recovery path when VTY authentication is misconfigured.

Configure VTY Passwords for Remote Access

VTY, or virtual terminal, lines accept remote management sessions. Telnet and SSH use VTY lines, although the protocol and authentication configuration determine whether a particular session is accepted.

Telnet transmits credentials and session data without encryption. SSH is the preferred remote-management protocol because it provides encrypted communication when correctly configured.

The number of VTY lines varies by IOS platform and software version. A common range is 0 15, but check the specific device before applying the configuration.

Router# configure terminal
Router(config)# line vty 0 15
Router(config-line)# password <VTY_PASSWORD>
Router(config-line)# login
Router(config-line)# end
Router#

The range in this example configures all VTY lines from 0 through 15. If the device supports a different range, use the complete supported range rather than assuming that 0 15 applies.

This basic line-password method does not by itself configure SSH keys, local usernames, AAA, or authorization. For a production device, prefer SSH with an appropriate authentication design and restrict unwanted protocols.

Configure the Enable Password

The enable password command defines a legacy credential for the transition from user EXEC mode to privileged EXEC mode.

Router# configure terminal
Router(config)# enable password <ENABLE_PASSWORD>
Router(config)# end
Router#

After returning to user EXEC mode, the enable command causes IOS to request the configured privileged-mode password.

Router# disable
Router> enable
Password: <ENABLE_PASSWORD>
Router#

An enable password has a security limitation: depending on IOS behavior and password-encryption settings, it may appear in a reversible or readable representation in the configuration. Privileged EXEC access is sensitive because it can lead to global configuration mode and broad control of the device.

Configure the Enable Secret

enable secret protects the same transition to privileged EXEC mode but is the preferred basic setting. IOS stores the secret as a password hash rather than as an ordinary clear-text configuration value.

Router# configure terminal
Router(config)# enable secret <ENABLE_SECRET>
Router(config)# end
Router#

If both an enable password and an enable secret exist, the enable secret takes precedence. For example:

Router(config)# enable password <LEGACY_ENABLE_PASSWORD>
Router(config)# enable secret <PRIVILEGED_SECRET>

When you later enter enable, use <PRIVILEGED_SECRET>, not the legacy enable-password value. In a real deployment, avoid configuring both unless compatibility or a lab exercise requires it.

Password Visibility and service password-encryption

The global command service password-encryption changes how certain applicable plain-text passwords are displayed in configuration output.

Router# configure terminal
Router(config)# service password-encryption
Router(config)# end

This feature provides reversible obfuscation, not modern strong password hashing. It can make line passwords and legacy enable passwords less immediately readable in show running-config, but it should not be treated as a strong protection mechanism.

An enable secret is different: its value is represented using a password hash. Password obfuscation in the configuration is also different from encrypting network traffic. service password-encryption does not make Telnet safe and does not encrypt credentials or session data sent across the network.

Mechanism	Protects device access	Hides configuration values	Encrypts network traffic	Security limitation
Line password with `login`	Yes, for the applicable console or VTY line	Only with applicable obfuscation settings	No	Shared credential and limited protection
Enable password	Yes, for privileged EXEC	Weak or reversible representation may be possible	No	Legacy setting
Enable secret	Yes, for privileged EXEC	Stored as a hash	No	Does not encrypt management sessions
`service password-encryption`	No, it changes display/storage representation	Obfuscates applicable plain-text passwords	No	Reversible obfuscation, not strong hashing
SSH	Supports remote authentication	Not a configuration-display feature	Yes, when correctly configured	Requires proper SSH and identity configuration

Verify the Configuration

Use verification commands from privileged EXEC mode. Never expose real credentials when copying output into notes or support requests.

Router# show running-config
Router# show running-config | section line
Router# show running-config | include enable
Router# show startup-config

show running-config displays the active, or running, configuration. The filtered commands help locate line sections and enable-related settings. Depending on platform and software version, passwords may be hidden, obfuscated, or represented by hashes.

In a redacted review, the relevant output may resemble the following. The displayed values are fictional representations, not usable credentials.

line console 0
 password <redacted-or-obfuscated>
 login
!
line vty 0 15
 password <redacted-or-obfuscated>
 login
!
enable secret <hash-representation>
! enable password may also appear if it was configured

To confirm that an enable secret overrides an enable password, check whether both commands are present, then enter enable from user EXEC mode using the enable-secret credential. The presence of both settings does not mean IOS will accept both values.

Save a Tested Configuration

The running configuration is active but may be lost after a reload. The startup configuration is the saved configuration used during the next boot.

Router# copy running-config startup-config

Save only after testing console, VTY, and privileged EXEC access. Confirm the device's save workflow completes successfully, then review the startup configuration if required:

Router# show startup-config

Troubleshooting

Console or VTY does not request a password

The login command may be missing under the intended line.
The password may have been configured under a different line or only part of the VTY range.
login local or AAA may be controlling authentication instead of the line password.

Inspect the applicable section with show running-config | section line. Confirm that the intended line contains both password and login, and check for alternate authentication commands before changing the configuration.

Remote management cannot connect

The selected VTY range may not match the platform's supported lines.
IP addressing or network reachability may be incorrect.
Transport restrictions may allow SSH only or otherwise limit inbound protocols.
All available VTY sessions may already be in use.

Verify IP connectivity independently of password configuration. Review the VTY settings and any transport-input restrictions. Use SSH rather than attempting Telnet when SSH is configured and supported.

The enable password fails after an enable secret is added

This is expected when both exist: the enable secret has precedence. Use the enable-secret credential, or remove or update the unintended setting according to the lab instructions or security policy.

Configuration values look encoded, but Telnet is still insecure

service password-encryption changes configuration representation; it does not encrypt Telnet traffic. Use SSH for encrypted remote administration and treat configuration protection and transport encryption as separate controls.

Remote access was lost after a change

An incorrect VTY password, authentication method, or transport restriction may have been applied. Keep an established session open while testing a new connection, and maintain tested console access before modifying remote authentication. If remote login fails, correct the configuration through the console.

Basic Security Recommendations and Limitations

Use unique, nontrivial passwords in real deployments. Do not reuse a shared lab password for production systems.
Prefer enable secret over enable password for basic local privileged-mode protection.
Prefer SSH over Telnet because Telnet does not encrypt credentials or session data.
Use local usernames with login local, AAA, and centralized authentication where appropriate instead of relying only on shared line passwords.
Remember that a person who reaches privileged EXEC mode may be able to enter configuration mode and alter device security.
Do not make access changes remotely without preserving a console or other tested recovery path.
Do not confuse reversible configuration obfuscation with strong password hashing or encrypted transport.

Exam-Relevant Summary

line console 0 selects the physical console line.
line vty <FIRST_VTY> <LAST_VTY> selects remote virtual terminal lines; the supported range varies by platform.
A line password is not normally requested until login is configured under that line.
User EXEC commonly ends with >; privileged EXEC ends with #; global configuration ends with (config)#; line configuration ends with (config-line)#.
enable secret takes precedence over enable password.
service password-encryption obfuscates applicable configuration values but does not provide strong hashing or encrypt Telnet.
show running-config reviews the active configuration, while show startup-config reviews the saved boot configuration.
copy running-config startup-config saves tested active settings for the next reload.

For continued study, see the Cisco IOS password configuration guide.