CCNA NOTES 5 # Console, Telnet & SSH Access — Complete Cisco Router Configuration Guide

 

Networking access notes covering Console, Telnet, and SSH configuration for Cisco routers

Cisco IOS — Remote Access

Console, Telnet & SSH Access

Complete configuration reference for router remote access methods — commands, theory & security notes.

Console Access

Local Only

What is it?Direct physical access to router using a console (rollover) cable — no network needed.

Line usedLine Console 0 — always the first and only physical console port on most routers.

When to useInitial setup, locked-out recovery, or when no network connectivity exists.

Configure console password

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# enable secret cisco          ! Encrypted privilege-mode password
R1(config)# line console 0
R1(config-line)# password cisco
R1(config-line)# login
R1(config-line)# end

Save & manage config

R1# copy running-config startup-config   ! Save to NVRAM
R1# write memory                          ! Shortcut — same as above
R1# reload                                 ! Restart router
R1# erase startup-config                  ! Wipe NVRAM (factory reset)

Telnet

TCP — Port 23

Full formTeletype Network — used for remote access of network devices over a network.

ProtocolEncapsulated in TCP, port 23. Target device must have Telnet enabled.

Line VTYVirtual Terminal lines — controls how many users can connect simultaneously (0–4 = 5 users).

Data transmissionAll data travels in clear-text (plain text) — easily intercepted on the network.

Security warning: Telnet sends all data including passwords as plain text. Anyone sniffing the network can read it. Use SSH instead for any production environment.

---

1. Configure Telnet

Router> enable
Router# configure terminal
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip address 192.168.1.1 255.255.255.0
Router(config-if)# no shutdown                  ! Activate interface
Router(config-if)# exit
Router(config)# line vty 0 4                  ! Open 5 virtual terminal lines
Router(config-line)# password cisco
Router(config-line)# login
Router(config-line)# transport input telnet
Router(config-line)# end

2. Connect via Telnet

! From a PC (command prompt):
telnet 192.168.1.1

! From another Cisco router:
Router# telnet 192.168.1.1

3. Remove Telnet access

Router(config)# line vty 0 4
Router(config-line)# no password
Router(config-line)# no login
Router(config-line)# transport input none
Router(config-line)# end

SSH — Secure Shell

TCP — Port 22

Based onFunctionally similar to Telnet but all data is fully encrypted end-to-end.

ProtocolEncapsulated in TCP, port 22. Requires RSA key pair for encryption.

AuthenticationUses local username + password stored on the router (login local).

Key sizeRSA key of 1024-bit (minimum) or 2048-bit (recommended) must be generated.

Telnet — plain textSSH — encryptedRSA public-key cryptography

RSA full form

R

Rivest
Ron Rivest

S

Shamir
Adi Shamir

A

Adleman
Leonard Adleman

SSH prerequisites (in order)

Step 1

Set a hostname (not default "Router")

Step 2

Set an IP domain name

Step 3

Create local username & password

Step 4

Generate RSA crypto key

Step 5

Set VTY lines to login local

Step 6

Allow only SSH transport input

1. Configure SSH

Router> enable
Router# configure terminal
Router(config)# hostname R1               ! Must NOT be "Router"
R1(config)# ip domain-name nb.com        ! Required for RSA key gen
R1(config)# username admin password cisco ! Local user account
R1(config)# crypto key generate rsa           ! Enter 1024 or 2048 when prompted
R1(config)# line vty 0 4
R1(config-line)# login local               ! Use local username/password
R1(config-line)# transport input ssh       ! Allow SSH only (blocks Telnet)
R1(config-line)# end

2. Connect via SSH

! From a PC (command prompt):
ssh -l admin 192.168.1.1

! From another Cisco router:
R1# ssh -l admin 192.168.1.1

3. Disable SSH (keep VTY active)

R1(config)# line vty 0 4
R1(config-line)# transport input none
R1(config-line)# end

4. Remove RSA keys completely

R1(config)# crypto key zeroize rsa          ! Destroys key pair — SSH stops working

Best practice: Always use SSH over Telnet. Set transport input ssh to block Telnet completely. Use 2048-bit keys for stronger encryption and create a strong username/password combination.