- [Instructor] Remote access to a Cisco device starts
with setting up passwords.
Passwords can be attached to telnet or SSH connections,
as well as the console port.
A console password is set by entering config mode, config t.
And then entering the line console command
with line console zero.
From here, I'll use password cisco.
I'll next enter the login command.
Login informs iOS to use a simple, shared password
with no user name for this interface.
I can then test by exiting out
and entering back in.
Now I'll hit Enter.
And be prompted for the password.
I'll type cisco, and there it is.
From here, I easily transition to enable mode
with no additional password.
To protect enable mode, I'll place a password.
Config t, enable secret gregsowell.
Now when moving from user exec to privilege exec,
I'll have an additional password for protection.
To enable Telnet with a basic shared secret,
I'll enter line mode for the available virtual terminals.
Line vty zero to 15.
Now I'll set the password to cisco.
Password cisco.
And issue the login command.
While this is functional,
all admins will use the same credentials,
which isn't ideal.
The system can be transitioned to use multiple
local user name password combinations,
which is generally preferred.
It actually only takes a few command modifications.
First I'll create a user name.
I'll make the user name admin with a password
of gregsowell.
Username admin secret
and then the password, gregsowell.
Now that I have a user name,
I'll configure the console to use it.
Line con zero.
And the secret sauce, login local.
Now to test.
And I'll put in the user name admin.
And password gregsowell.
Enable mode, gregsowell.
And I'm in.
While local user names are a good step up from simple
shared passwords, ultimately a remote authentication
system like RADIUS or TACACS+ should be used
for centralized authentication services.
RADIUS is discussed in more detail in a later chapter.
As stated previously, SSH is preferred over Telnet
for its encrypted remote connectivity.
SSH, unlike Telnet, requires both a username and password
combination.
And since I've already configured the user admin,
I can move forward with the required configurations
for SSH.
First, I need a host name applied to the router.
I already have one,
but for consistency, I'll add it again.
Host router one.
Next I need a domain name configured.
Ip domain-name gregsowell.com.
Both the host name and domain are required
to generate the crypto keys for the SSH session.
Speaking of, I'll now issue the crypto key generate rsa
command.
I'll go ahead and make the bit string 1024.
Now that the keys are in place, I'll designate
what kind of protocol I want to be used.
This is done under the VTY sub-menu.
Line vty zero 15.
Using the transport input command,
if I hit the question mark,
I see several options here.
I'm concentrating on three,
Telnet, SSH, and ALL.
I can choose ALL,
which will use everything shown.
Or if I only want SSH, I'll add just that.
And if I want SSH or Telnet,
I'll add SSH then Telnet.
Some Cisco devices require the transport input command
to allow any remote connectivity,
while some only require it for SSH.
So as a best practice, add it on everything.
The next step is to add an IP address
that will be reachable on the network.
That will be covered in the configuring IPV four addressing
chapter.
For now, this device is up on the network,
so I can test SSH access to it now.
Username is admin,
and the password is gregsowell.
Here's a couple of commands that can make life easier
as an administrator.
The first is logging synchronous.
If I'm typing on the CLI,
and the system has a message output to the console,
it will put that text smack in the middle of my command.
This doesn't change what I've typed,
but it can make reading what's there impossible.
If I enter into the console or VTY sub-menu,
line con zero and enter the logging sync command,
the system will now display the console message,
then move my command to a new line as if nothing happened.
The next must-have command is no IP domain-lookup.
If I mistype a command from enable mode,
iOS will try and resolve it as a DNS name,
which can take a decent bit of time to time out
before it gives me the prompt back.
Once I put the no IP domain-lookup command in,
it will no longer attempt the lookup
and immediately give me the console back.
99.9% of all network administration is done remotely,
so understanding this chapter will be essential
to your career in engineering.