How to Configure SSH on a Cisco Router

Configuring SSH (Secure Shell) on a Cisco router allows you to securely manage and access the router remotely. Here are the steps to configure SSH on a Cisco router:

1. Access the Command Line Interface (CLI):
   Connect to your Cisco router via console cable or SSH.
2. Enter Privileged Exec Mode:
   Once connected, enter privileged exec mode by typing:

   enable

Provide the enable password if required.

3. Enter Global Configuration Mode:
   To configure SSH, enter global configuration mode:

   configure terminal

This command allows you to make changes to the router’s settings.

4. Generate an RSA Key Pair:
   You need an RSA key pair to enable SSH. Use the following command to generate one:

   crypto key generate rsa general-keys modulus <modulus_size>

Replace with the desired key size, typically 1024, 2048, or 4096 bits. For example:

   crypto key generate rsa general-keys modulus 2048

This generates the RSA key pair used for SSH encryption.

5. Configure SSH:
   Next, configure SSH on the router by enabling the SSH server and specifying various parameters:

   ip ssh version 2
   ip ssh time-out <timeout_seconds>
   ip ssh authentication-retries <retry_count>

Replace with the desired timeout value (in seconds) and with the number of authentication retries allowed.

For example:

   ip ssh version 2
   ip ssh time-out 120
   ip ssh authentication-retries 3

6. Create Usernames and Passwords for SSH:
   Create usernames and passwords for SSH access. Use the following command:

   username <username> privilege <privilege_level> secret <password>

Replace , , and with your desired values. The privilege level should typically be 15 for full administrative access. For example:

   username myadmin privilege 15 secret MySecurePassword

7. Assign SSH Access to VTY Lines:
   To allow SSH access on the virtual terminal (VTY) lines, use the following command:

   line vty 0 4
   transport input ssh
   login local

The transport input ssh command restricts access to SSH, and login local enables local authentication using the usernames and passwords you created earlier.

8. Set the Domain Name (Optional):
   It’s a good practice to set a domain name for the router, which is used for generating SSH key fingerprints:

   ip domain-name <domain_name>

Replace with your desired domain name.

9. Save the Configuration:
   After configuring SSH, save the configuration:

   write memory

or

   copy running-config startup-config

This ensures that your SSH settings persist after a reboot.

10. Test SSH Access:
    Test SSH access to the router from a remote device using an SSH client. Connect using the configured username and password.

That’s it! You’ve configured SSH on your Cisco router, allowing secure remote access to the device. Remember to keep your SSH credentials secure and follow best practices for network security.