- [Instructor] So, we're going to go through Telnet and SSH
and we're going to start with the corp router.
We're going to Telnet, use Telnet, Telephone Network,
to get into the San Francisco router,
let's go ahead and take a quick look.
Very, very simple.
I'm gonna log in here,
and then I can do Telnet 172.16.10.1,
that's the San Francisco IP address.
But notice I can do this,
I don't need to type in the command Telnet,
I can just type in the IP address.
This is a feature of the Cisco router
that you can either type in the IP address
or use the command Telnet
or you can type in a host name and it'll resolve it.
Let's try that again, 172.16.10.2.
Now it is now when I type this in,
I'm gonna be in the San Francisco router.
Be careful if you Telnet to yourself like I just did,
you can create a loop here.
So now I can do things like show users out here.
See that I'm in line 514, then say clear line,
it won't let me clear it
because that's the line that I'm in,
but you could do something like that.
So now that we're in the San Francisco router,
let's go ahead and do this,
and I want to configure it for SSH
because we don't really want to use
Telnet in production, right?
So the first thing I want to do is create a local database.
And this is the username and password I'll use to log in.
I could've also added privilege 15 in there,
which meant that when I logged in with Todd Lammle,
that it would have ended up in privileged mode.
Next thing I want to do is set a domain name
and this is going to be used
with the host name to generate the key.
Doesn't matter what name you use,
if you're using DNS resolved names
then you already have that set.
Okay, then we're going to say crypto key generate rsa.
And again it's gonna use those two things,
and it's gonna ask me,
I gotta spell crypto right.
Tab key is your friend now.
So with the crypto key generate rsa, I'm gonna press enter
it's gonna give me the keys that I want, the size.
I'm gonna say yes, I've already done this before
on this router as I was testing it,
so it's gonna say hey you already have keys defined.
I'm gonna say yes, it's gonna ask me the key size,
this is what it would be look like, 512, 1024.
I usually go in the middle.
The thing about this,
if you do 1024 you can't run SSH version 1,
so I'm gonna type in SSH version 2.
IP SSH version 2.
There we go.
All right, and now that I have my RSA server configured,
I still have to do one more thing.
I need to go to my lines in Telnet,
and I'm gonna choose hotlines,
you saw why when I did the Telnet.
I'm gonna say log in, use the local database,
to authenticate users coming in through the vty lines.
The other thing I want to do is transport input,
Telnet, as the default.
So what I want to say is transport input SSH,
and now I'm saying only SSH is allowed in on the vty lines.
Now I could do something else like Telnet or all,
and one of the things I've seen on there,
which (mumbles) is,
input SSH all, or SSH, or just input all.
Don't do that, that gives you all of these PAD and LAT,
and all these insecure protocols.
So you could do this though,
SSH Telnet, and say, all right we SSH
but we do allow Telnet if you want.
I'm gonna go ahead and do that.
That's completely up to you.
Now to test this, at this point I'm Telnetted in
so I'm gonna get out of my Telnet.
I can still Telnet in because I did transport input,
now, in this case I'm gonna say SSH,
the client on the Cisco router switches it very nice.
This is a minus L, not a minus one.
Although if I type a one, look at that.
That's a one, you can barely tell the difference.
Minus L, and then the username, which was Todd,
and then the IP address.
And so we can see now I'm in,
and then the password was Lammle.
So when I do an SSH -l for log in,
the username and the IP address,
we're then gonna SSH in, my password here is Lammle,
and I'm not SSHed in.
So I can do show users,
and see that I'm in line 514 again,
but my username is Todd here, isn't it?
Now one more quick thing I want to show you
is I'm gonna get out of here, I'm gonna type exit,
and I wanna on the corp router, I'm gonna say config t.
IP host San Francisco 172.16.10.2.
In this case here now, watch this.
Now in my sys log.
So I'm gonna say SSH -l Todd SF.
Whoa, look at that.
And then I type in Lammle,
and I'm not SSHed in using the hostname.
So the IP host, the hostname, and IP address,
allows me not to have to use the IP address.
I could just use the name,
so if I go back to corp,
I could say ping SF, for example, right?
So in this section we learned about Telnet and SSH,
and how to verify those.