Networks Training

  • About
  • My Books
  • SUGGESTED TRAINING
  • HOME
  • Cisco Networking
    • Cisco General
    • Cisco IOS
    • Cisco VPN
    • Cisco Wireless
  • Cisco ASA
    • Cisco ASA General
    • Cisco ASA Firewall Configuration
  • Certifications Training
    • CCNA Training
    • Cisco Certifications
    • I.T Training
  • General
    • General Networking
    • IP Telephony
    • Network Security
    • Product Reviews
    • Software
  • Cisco Routers
  • Cisco Switches
You are here: Home / Cisco IOS / How to Disable Telnet and Enable SSH on Cisco Devices

How to Disable Telnet and Enable SSH on Cisco Devices

Written By Harris Andrea

I should have written this article from the very beginning of starting this blog because it is one of the most fundamental configuration steps for managing a Cisco networking device (router, switch, firewall etc).

how to disable telnet and enable ssh on cisco routers and switches

Disabling Telnet and enabling SSH on a networking device is also a step forward in increasing security in the whole network. Encrypted communication is a must nowadays, something that most professionals didn’t pay much attention a few years ago.

There are several ways to manage a Cisco device. Here are the most popular ones:

  • Direct Console Access: Uses a special serial cable to connect directly to the console port and get a Command Line Interface(CLI) to the device.
  • Telnet Access: Remote management of the device from the network. Gives authenticated Command Line access to the device but the whole communication is not encrypted.
  • SSH Access: Remote management of the device form the network (just like Telnet) but the whole traffic is encrypted by the SSH protocol.

There are some more management ways (depending on the device) such as HTTPs Web access, management through an application etc, but the above 3 are the most common options.

Moreover, disabling Telnet and enabling SSH is one of the best practices suggested by the official Cisco Hardening Guide for IOS devices to secure the management plane. For a more practical guide to harden Cisco routers and switches in 10 steps have a look at our post here.

MORE READING:  Cisco Access List Configuration Examples (Standard, Extended ACL) on Routers Etc

Disable Telnet on Cisco Routers/Switches

Let’s see first how to disable Telnet on a Cisco IOS device which covers both Routers and Switches.

Each Telnet access to the device (same applies with SSH as well) uses one of the VTY lines (Virtual Terminal lines).

You need to have in mind that older IOS versions (before 12.2) had 5 VTY lines (numbered 0 to 4), whereas newer IOS versions (after 12.2) have 16 VTY lines (numbered 0 to 15).

Therefore, to disable Telnet you need to do this action on all the VTY lines.

The following configuration will disable Telnet and all other remote network access:

CiscoDevice(config)# line vty 0 15    <– configure all 16 VTY lines
CiscoDevice(config-line)# transport input none   <– disable Telnet and everything else

If you do the above config, the only way to connect to the router or switch is with direct console access.

Controlled Access to Telnet

Another way to control Telnet access to routers and switches is to apply an Access Control List (ACL) on the VTY lines and allow only specific management IPs to connect.

With this method you don’t disable Telnet completely but you just control access to it from management stations.

CiscoDevice(config)# enable secret strongenablepass <– first configure enable password
CiscoDevice(config)# access-list 10 permit 192.168.1.0 0.0.0.255 <– create ACL for subnet 192.168.1.0/24
CiscoDevice(config)# line vty 0 15
CiscoDevice(config-line)# access-class 10 in <– allow subnet above only to access the device via Telnet
CiscoDevice(config-line)# password strongtelnetpass <– configure password on Telnet lines
CiscoDevice(config-line)# login <– ask for Telnet password

MORE READING:  Cisco IOS Zone Based Firewall Configuration Example (ZBF)

Enable SSH on Cisco Routers/Switches

By enabling SSH and configuring this transport protocol on the VTY lines of the IOS device, it will automatically disable Telnet as well.

So lets see how to enable SSH. First you need to generate SSH keys and then enable SSH transport on VTY lines.

CiscoDevice# config terminal

CiscoDevice(config)# enable secret strongenablepass <– first configure enable password

CiscoDevice(config)# username admin password adminpass <– it’s a good practice to create local administration user (if you don’t have external AAA server)

CiscoDevice(config)# hostname NewYork

NewYork(config)# ip domain-name mycompany.com <– configuring hostname and domain name are necessary for creating SSH keys

NewYork(config)# ip ssh version 2 <– use more secure SSH v2

NewYork(config)# crypto key generate rsa modulus 2048 <– create 2048 SSH key

NewYork(config)# ip ssh time-out 60 <– self explanatory

NewYork(config)# ip ssh authentication-retries 3  <– self explanatory

NewYork(config)# line vty 0 15

NewYork(config-line)# transport input ssh <– enables SSH and disables Telnet on all VTY lines

NewYork (config-line)# login local <– use local user for authentication.

SSH requires to have a hostname and domain-name configured and also to generate SSH keys. Also, on VTY lines allow SSH protocol only which means that Telnet is disabled automatically.

Related Posts

  • How to Configure SNMP on Cisco Devices (Routers, Switches)
  • Comparing Cisco IOS Configurations (Config Compare Tools)
  • Cisco Access List Configuration Examples (Standard, Extended ACL) on Routers Etc
  • PPTP Remote Access VPN Configuration on Cisco Routers
  • Cisco IOS Zone Based Firewall Configuration Example (ZBF)

Filed Under: Cisco IOS

Download Free Cisco Commands Cheat Sheets

Enter your Email below to Download our Free Cisco Commands Cheat Sheets for Routers, Switches and ASA Firewalls.

We use Elastic Email as our marketing automation service. By submitting this form, you agree that the information you provide will be transferred to Elastic Email for processing in accordance with their Terms of Use and Privacy Policy. Also, you allow me to send you informational and marketing emails from time-to-time.

About Harris Andrea

Harris Andrea is an Engineer with more than two decades of professional experience in the fields of TCP/IP Networks, Information Security and I.T. Over the years he has acquired several professional certifications such as CCNA, CCNP, CEH, ECSA etc.

He is a self-published author of two books ("Cisco ASA Firewall Fundamentals" and "Cisco VPN Configuration Guide") which are available at Amazon and on this website as well.

Comments

  1. Ehab Sharaf says

    December 19, 2019 at 12:03 pm

    thanks alot for valuable info

  2. Harris Andrea says

    December 19, 2019 at 2:59 pm

    You are welcome Ehab.

    Harris

  3. Kesomi Taufa says

    May 18, 2020 at 3:14 pm

    Great article Harris! Simple enough to follow.

  4. Harris Andrea says

    May 18, 2020 at 5:19 pm

    Kesomi, I’m glad you’ve liked my article and that was helpful to you.

    Have a great day

    Harris

  5. Joseph says

    June 7, 2020 at 5:58 am

    Thanks for the content it really help…

  6. Joseph from South Africa says

    June 7, 2020 at 6:00 am

    Im new in Cisco what are the core basic skills to learn , i see the website has valuable information

  7. Harris Andrea says

    June 7, 2020 at 8:29 am

    You are welcome Joseph, have a nice day.

  8. Harris Andrea says

    June 7, 2020 at 8:30 am

    The core basic skills include basic routing and switching skills. Start by looking at CCNA preparation which will give you the basic skills in networking.

  9. sameh says

    August 24, 2020 at 5:28 pm

    Simple enough to follow

  10. Abdul Azim says

    March 13, 2022 at 1:17 pm

    very nice

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Search this site

About Networks Training

We Provide Technical Tutorials and Configuration Examples about TCP/IP Networks with focus on Cisco Products and Technologies. This blog entails my own thoughts and ideas, which may not represent the thoughts of Cisco Systems Inc. This blog is NOT affiliated or endorsed by Cisco Systems Inc. All product names, logos and artwork are copyrights/trademarks of their respective owners.

Amazon Disclosure

As an Amazon Associate I earn from qualifying purchases.
Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates.

Search

BLOGROLL

Tech21Century
Firewall.cx

Copyright © 2023 | Privacy Policy | Terms and Conditions | Hire Me | Contact | Amazon Disclaimer | Delivery Policy

896 shares