3

I would like to log into a Cisco router that is in a LAN

  • via telnet or ssh
  • as user <username> with a password <password>
  • only from machines in the LAN 192.168.2.0/24

About the user:

I usually use the flat blue cable and connect to the router using Hyperterminal. I run enable and then I'm asked for a password. So I don't know the username associated with this password... What is the associated username?

Suppose it is <username>. I would like to run telnet 192.168.2.1 -l <username> and then enter the password. Or ssh <username>@192.168.2.1 and then enter the password.

I want this user to be able to telnet or ssh into the router only from machines inside the LAN 192.168.2.0/24.

I don't know precisely how to do that.

Do I need an access-list like this one?

access-list 101 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.1 eq 23

or

access-list 101 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.1 eq 22

Then do I have to associate this access-list to the router inside network interface (VLan1)?

Can you help me set up the sequence of commands I have to run to achieve that goal?


EDIT N°1

Ok. I ran:

conf t
line vty 0 4
login local

and:

conf t
username <username> privilege 15 secret <password>

I can log into the router as:

telnet 192.168.2.1
Username: <username>
Password: <password>

Question 1: How to make sure the router cannot be telneted into from outside the LAN?

Question 2: I cannot log into the router via SSH:

ssh <username>@192.168.2.1
ssh: connect to host 192.168.2.1 port 22: Connection refused
  • You need to set up the VTY lines for this. You can specify telnet or SSH, and you must have some type of authentication. – Ron Maupin Oct 4 '17 at 17:07
  • Did you include the transport for SSH in your VTY configuration? – Ron Maupin Oct 4 '17 at 17:37
  • To restrict access, you need to add the ACL and access class statements from the answer below. For ssh, you need to enable the ssh server. I forget the exact commands off of the top of my head. I could look them up -- but so could you. – Ron Trunk Oct 4 '17 at 17:42
  • I don't know how to do that. Ron T. suggested the command: "access-class ONLY-THESE-GUYS in transport input ssh telnet" but with the router Cisco 887VA I am using, the maximum command I can enter is "access-class 50 in" (given that I entered this before: "access-list 50 permit 192.168.2.0 0.0.0.255") – Léa Massiot Oct 4 '17 at 17:42
  • I edited my answer below. Forgot the "ip access-list" – Ron Trunk Oct 4 '17 at 17:44
4

You can use these commands to set up telnet access

! Set username/password
username Lea password Shhh! 
! Create standard ACL to control access
ip access-list standard ONLY-THESE-GUYS
 permit 192.168.2.0 0.0.0.255
! Enable authentication 
aaa new-model
aaa authentication login default local
! enable virtual terminal sessions
line vty 0 15
access-class ONLY-THESE-GUYS in
transport input ssh telnet

Now you should be able to telnet to 192.168.2.1.

  • Thank you Ron Trunk. I studied carefully this sequence of commands and could achieve my goals. I also ran the "crypto" command like @jonathanjo suggested to be able to login via SSH into the router. – Léa Massiot Oct 6 '17 at 14:50
5

You'll need to have a hostname and a domain and generate the keys for ssh to work. My notebook says:

hostname gw99
ip domain name example.com

crypto key generate rsa modulus 2048

ip access-list standard LEGIT
 permit 192.168.2.0 0.0.0.255

line vty 0 4
 access-class LEGIT in
 privilege level 15
 transport input ssh

As no one else has mentioned it ... generally it's not considered safe to allow telnet, much better to stick to ssh.

Kind regards,

Jonathan.

  • Thank you. The "crypto" command was indeed necessary. Kind regards. – Léa Massiot Oct 6 '17 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.