VMware ESXi and vSphere Cluster Management

How to Enable SSH on a Cisco Router

Learn how to configure secure SSH-only remote management on a Cisco IOS router, create RSA keys and local credentials, verify access, and disable Telnet on VTY lines.

Secure Shell (SSH) provides encrypted command-line management for Cisco IOS routers. This lesson shows how to configure a router for SSH-only access, authenticate users from the local database, verify the configuration, and restrict management access when needed.

Why SSH Is Preferred to Telnet

Telnet is an older remote terminal protocol. It sends login credentials and management traffic without encryption, so someone able to observe the network may capture usernames, passwords, and commands.

SSH, or Secure Shell, is an encrypted protocol for remote command-line management. It protects the remote session from network observation and should be used instead of Telnet for administrative access.

How Cisco IOS SSH Works

Cisco IOS uses VTY lines to control inbound virtual terminal sessions. The VTY configuration determines how a remote client authenticates and which protocols it may use.

The router also needs an RSA public/private key pair. The public key can be shared with clients during the SSH exchange, while the private key remains on the router. Generating RSA keys enables the IOS SSH server capability.

• SSH: Secure Shell, an encrypted remote-management protocol.
• VTY lines: Virtual terminal lines that control inbound remote-access sessions.
• RSA keys: Public/private cryptographic keys used by the IOS SSH server.
• Local database: The IOS database containing locally configured usernames and secrets.
• RSA modulus: The key-size value selected during RSA key generation.

Prerequisites for SSH on Cisco IOS

• The router must have an active management IP address reachable from the client.
• The router must have a configured hostname, which is the device name in IOS.
• The router must have a configured domain name, which is used with the hostname during RSA key generation.
• The IOS image and platform must support the required cryptographic features.
• RSA keys must be generated for the SSH server.
• A local username and secret must exist if local authentication is being used.

In the examples, the router is named RTR1, its domain is mydomain.local, and its management address is 10.0.0.20. Replace these values and the example secret with values appropriate for your network.

Configure the Router Identity

Enter privileged EXEC mode and then global configuration mode. The hostname and domain name form the name associated with the RSA key pair.

enable
configure terminal
hostname RTR1
ip domain-name mydomain.local

The prompt changes when the hostname is set. The domain name is not necessarily a public DNS domain; it is the IOS domain value required for key generation and device identity.

Create a Local Administrative User

Create a local user with the username command. Use the secret form rather than an unprotected password where the platform supports it.

username sshuser secret <strong-secret>

During an SSH connection, the client supplies sshuser as the username and the configured secret as the password. Do not use the literal placeholder or a shared example credential in production.

Generate RSA Keys

Generate the RSA key pair from global configuration mode:

crypto key generate rsa modulus 2048

The modulus is the RSA key-size value. A larger modulus generally provides greater cryptographic strength but may require more processing time, especially on older router hardware. Use a modern modulus supported by the platform and approved by your organization's security policy. Key creation may take time while the router generates the key pair.

Some IOS versions ask for the modulus interactively instead of accepting it on the same command line. If prompted, enter an appropriate supported value. RSA key generation is the event that enables the IOS SSH server capability.

Select SSH Version 2

SSH version 2 is preferred over legacy SSH version 1. Configure it when supported:

ip ssh version 2

Configure the VTY Lines for SSH Only

Configure the VTY lines to use the local username database and accept SSH instead of Telnet. Many platforms support VTY lines 0 15, but the exact range can vary by platform and IOS release.

line vty 0 15
login local
transport input ssh

login local tells IOS to authenticate against the local database. transport input ssh permits SSH connections and excludes Telnet on the selected VTY lines.

Finish configuration mode and save the configuration after testing:

end
copy running-config startup-config

The running configuration is active immediately, while the startup configuration is used after a reboot. Save only after validating that management access works.

Complete Basic SSH-Only Configuration

The following sequence configures the example router from privileged EXEC mode:

enable
configure terminal
hostname RTR1
ip domain-name mydomain.local
username sshuser secret <strong-secret>
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 15
login local
transport input ssh
end
copy running-config startup-config

Verify the SSH Configuration

Use show commands from privileged EXEC mode to confirm the identity, keys, SSH service, VTY settings, and management interface.

Connect from an SSH Client

From a reachable workstation, use a graphical client such as PuTTY or a command-line SSH client. Connect to the router's management IP address:

ssh sshuser@10.0.0.20

The client may display a host-key confirmation the first time it connects. Review and accept it only when the device identity is trusted according to your operational process. Enter the local user's secret when prompted.

After successful authentication, the client should display the router's user EXEC prompt, similar to:

RTR1>

At the user EXEC prompt, enter enable only if you need privileged EXEC access and the router is configured for that privilege transition.

Restrict SSH Access to a Management Subnet

SSH encryption protects the session, but it does not decide which source networks may connect. An access control list (ACL) can limit VTY access to an authorized management subnet.

ip access-list standard MGMT-SSH
 permit 10.0.0.0 0.0.0.255
line vty 0 15
 access-class MGMT-SSH in
 login local
 transport input ssh

In this example, only clients sourced from 10.0.0.0/24 are permitted to establish VTY sessions. Apply an ACL carefully so that you do not lock out your approved management path. Where the platform design supports it, use an authorized management network or a management VRF as an additional control.

Security Considerations

• Use transport input ssh rather than allowing both Telnet and SSH.
• Use strong, unique secrets for local users. Never reuse the example credential.
• Limit VTY access with an ACL when management should come only from a trusted subnet.
• Use a dedicated management network or management VRF where supported by the platform design.
• Prefer SSH version 2 and a current, supported IOS release with approved cryptographic capabilities.
• Validate SSH access before saving, especially when changing VTY authentication or applying an ACL.
• Save the verified configuration with copy running-config startup-config.

Troubleshooting SSH on Cisco IOS

RSA key generation is unavailable or fails

• Confirm that hostname and ip domain-name appear in the running configuration.
• Run show crypto key mypubkey rsa to check whether keys already exist.
• Confirm that the platform and IOS image support SSH and the required cryptographic feature set.
• Do not replace existing keys casually; review the operational impact first.

The SSH connection is refused or times out

• Verify reachability with ping and confirm the client's routing path.
• Run show ip interface brief and confirm that the management interface has the correct address and is up/up.
• Run show ip ssh and confirm that SSH is enabled and RSA keys exist.
• Review every applicable VTY range and confirm transport input ssh.
• Check VTY access-class settings, firewalls, ACLs, and other management-plane policies that may block TCP port 22.

Authentication fails

• Check that the username and secret entered by the client are correct.
• Confirm that login local is configured on the intended VTY lines.
• Review AAA method lists if AAA is enabled; AAA configuration may override local authentication.
• Check whether the tested VTY line range differs from the range that was configured.
• Review configured usernames without exposing sensitive secrets.

Telnet still works

• The VTY configuration may allow both protocols.
• Only part of the VTY range may have been configured.
• Run show running-config | section line vty.
• Apply transport input ssh to all applicable VTY ranges and test again.

The client reports a protocol or algorithm mismatch

• Verify ip ssh version 2.
• The device may use an old IOS release or cryptographic algorithm that the client rejects.
• Use a supported IOS release and platform capability set, following the organization's cryptographic policy.

Exam-Relevant Notes

• SSH requires a hostname, domain name, RSA keys, and a user authentication method.
• login local uses the locally configured username database.
• transport input ssh permits SSH and excludes Telnet on the selected VTY lines.
• ip ssh version 2 selects the preferred modern SSH protocol version.
• The management IP address must be reachable before an SSH client can connect.
• Always verify the complete VTY configuration because platforms may have different VTY line ranges.

For a concise reference, see the Cisco router SSH configuration guide.