VMware ESXi and vSphere Cluster Management

Using Telnet on Cisco IOS Devices

Learn how to start, suspend, resume, and close Telnet sessions on Cisco IOS, configure VTY lines, verify access, troubleshoot problems, and understand Telnet security limits.

Telnet is a remote terminal protocol that provides text-based access to another device's command-line interface (CLI). Cisco IOS can act as both a Telnet client, which starts an outbound connection, and a Telnet server, which accepts inbound connections.

This lesson covers basic Telnet operation on Cisco IOS routers and switches, including VTY configuration, session control, verification, troubleshooting, and the security difference between Telnet and SSH.

Telnet fundamentals

A Telnet client is the software or IOS functionality that initiates a connection. A Telnet server is the service on the destination device that accepts the connection. In a Cisco-to-Cisco example, the local router runs the client and the remote router accepts the connection through its configured virtual terminal lines.

After the connection succeeds, commands you enter are interpreted by the remote device. This is important: a command entered during an active Telnet session changes or displays information on the destination device, not on the router from which you started.

Telnet requires two basic conditions:

• The local device must have Layer 3 reachability to the destination address.
• The destination must have an available and correctly configured Telnet service on its VTY lines.

Important terms

• VTY line: A virtual terminal line used for inbound remote-management connections such as Telnet or SSH.
• Authentication: The process of validating credentials or another approved access-control method.
• User EXEC mode: A limited IOS mode commonly shown with a > prompt.
• Privileged EXEC mode: A higher-privilege IOS mode commonly shown with a # prompt.
• Escape sequence: A keyboard sequence that suspends an active remote session and returns to the local CLI.
• Concurrent session: One of several remote sessions active at the same time.

Starting an outbound Telnet session

Start an outbound session from privileged EXEC mode with the destination IPv4 address:

R2# telnet 192.0.2.1

In this example, R2# is the local prompt before connecting. If R1 accepts the connection, the prompt changes to reflect R1:

Trying 192.0.2.1 ... Open

Password:
R1>

The exact connection messages vary by IOS release and terminal software. The significant change is the hostname: the prompt now identifies R1, so commands are running on R1. The > indicates user EXEC mode. If you enter privileged EXEC mode on the remote device, the prompt becomes:

R1> enable
R1#

Do not assume that the device is local because the terminal window was opened from R2. Always check the hostname and privilege character before entering a potentially disruptive command.

Example: connect from R2 to R1

Assume R2 can reach R1 at 192.0.2.1 and R1 has VTY access configured. From R2, run:

R2# telnet 192.0.2.1

After authentication, use a harmless identification or verification command on the remote device:

R1# show running-config | section line vty

This command displays R1's VTY configuration. It does not display R2's configuration because the active CLI context is R1.

Recognizing the active remote context

IOS prompts commonly contain the device hostname and a privilege indicator:

A hostname alone is not a security boundary. Two devices might have similar names, and a suspended session returns you to the originating device. Before changing configuration, confirm both the hostname and the mode indicator. A mistaken command context can result in changing the wrong router or switch.

Suspending and resuming a Telnet session

An active Telnet connection can be suspended without being terminated. While the remote session is active, press the IOS escape sequence:

Ctrl+Shift+6, then x

After the sequence, IOS returns you to the originating device's EXEC prompt. The remote connection remains open in the background. For example:

R1# [press Ctrl+Shift+6, then x]
R2#

To resume the suspended connection from the originating device, press Enter twice:

R2# [press Enter]
R2# [press Enter]
R1#

The control-key sequence can be intercepted by some terminal emulators. If it does not work, check the emulator's keyboard mappings. A separate console connection can also provide a recovery path.

Closing a Telnet session

To end the remote session, enter exit from the remote device's EXEC prompt:

R1# exit
R2#

The connection is closed and the prompt returns to the originating device. This differs from suspension: suspension keeps the connection available for later resumption, while exit terminates it.

Configuring the Cisco IOS Telnet server

Inbound remote terminal access is controlled through VTY lines. VTY lines are logical lines rather than physical ports. They provide access for remote protocols such as Telnet and SSH.

A basic lab configuration selects the VTY lines, assigns a line password, and enables password checking with login:

R1# configure terminal
R1(config)# line vty 0 15
R1(config-line)# password lab-vty-password
R1(config-line)# login
R1(config-line)# end
R1#

The line vty 0 15 command selects VTY lines 0 through 15. The password command defines the password for those lines, and login tells IOS to prompt for and check that password when an inbound connection uses the lines.

A password without login is not a complete password-based VTY configuration. Conversely, the exact authentication behavior can also be affected by local usernames, AAA, access-class settings, and platform-specific configuration. Verify the effective configuration rather than assuming that one command controls every access policy.

VTY line ranges and simultaneous access

Many Cisco IOS platforms number VTY lines beginning at 0. A commonly used platform configuration has 16 lines, numbered 0 through 15:

line vty 0 15

The number of available and permitted VTY lines affects how many remote sessions may be active concurrently. Sixteen configured lines can provide up to sixteen possible line allocations, but the actual limit depends on the platform, IOS release, other configuration, and resource availability. Always check the device's available lines and current sessions.

Platform support varies. If a device does not accept line vty 0 15, inspect its available line numbers and configure the supported range instead.

Verifying connectivity and configuration

Check IP reachability before testing Telnet. From the originating device, verify the destination address with ping where permitted:

R2# ping 192.0.2.1

A successful ping does not guarantee that Telnet will work, but failure indicates that addressing, routing, interface status, filtering, or another Layer 3 problem should be investigated first.

On the destination device, inspect the active VTY configuration:

R1# show running-config
R1# show running-config | section line vty

Confirm the following:

• The destination IP address is correct and belongs to the intended device.
• The management interface is up and has a usable address.
• The VTY range exists on the platform.
• The intended password or authentication method is configured.
• login is present when line-password authentication is intended.
• No access-class, ACL, firewall, or transport restriction blocks the connection.

On IOS platforms that support it, inspect outbound or suspended sessions with:

R2# show sessions

Use the output to determine whether a remote connection is active or suspended. Session display commands and their output can differ by platform and release.

Telnet security limitations

Telnet does not encrypt credentials or session traffic. Usernames, passwords, commands, and returned output can be observed by someone who can capture the traffic. For this reason, Telnet is generally appropriate only for controlled labs, legacy environments, or isolated trusted networks.

SSH is the preferred remote-management protocol for production because it provides encrypted communication and better protection for authentication and session data. During an SSH migration, configure and test SSH first, then restrict VTY transport to SSH as required by the platform and organization. Remove or disable Telnet access after confirming that approved management paths work.

Troubleshooting Telnet

Telnet cannot connect

• Verify the destination IPv4 address.
• Use ping to test reachability where permitted.
• Check interface status, addressing, routing, and the management IP.
• Confirm that the destination VTY lines are configured for the intended access method.
• Check whether an ACL or firewall blocks TCP port 23.
• Review transport restrictions and confirm that Telnet is actually permitted.

A password prompt appears, but authentication fails

• Check whether the entered password matches the configured VTY password.
• Inspect the VTY configuration and confirm the intended authentication method.
• Check for an access-class or source-address policy.
• Determine whether all permitted VTY lines are already occupied.
• Review relevant AAA or local-user configuration if the device uses a method other than a line password.

The command context is unclear

Read the hostname and privilege character in the prompt. If necessary, run a harmless identification command and inspect show sessions on the originating device when supported. Remember that suspending a session changes the visible prompt back to the originating device.

The escape sequence does not return to the local device

Enter Ctrl+Shift+6, then release the keys and press x. If the terminal emulator intercepts the combination, inspect its keyboard mappings or use a separate console connection for recovery.

Telnet is rejected by policy

This is expected in environments that require encrypted management. Confirm the approved standard, configure SSH, restrict VTY transport to SSH as appropriate, and remove Telnet access after migration.

Practice checklist

1. Configure a reachable management address on R1 and verify it from R2 with ping.
2. On R1, enter line vty 0 15, configure a lab password, and enter login.
3. From R2 privileged EXEC mode, start telnet 192.0.2.1.
4. Confirm that the prompt changes from R2 to R1.
5. Run a harmless command and identify it as a remote operation.
6. Suspend the session with Ctrl+Shift+6, then x.
7. Confirm that the R2 prompt returns, then press Enter twice to resume R1.
8. Use exit from the remote prompt and confirm that the session ends.
9. Inspect show running-config | section line vty and compare the result with the intended configuration.

Exam-relevant notes

• telnet <destination-ip-address> is an outbound client command used from privileged EXEC mode.
• VTY lines control inbound remote access; they are not physical interfaces.
• Common VTY numbering starts at 0, and a common 16-line range is 0 15.
• password and login together form the basic line-password configuration.
• Ctrl+Shift+6, then x, suspends a session; it does not close it.
• exit from the remote EXEC prompt closes the Telnet session.
• Telnet is unencrypted; SSH should be used for secure production administration.

For secure remote administration, continue with Telnet and remote CLI access practice while treating Telnet as a lab or legacy protocol rather than a production default.