Telnet or SSH into a Cisco router

Question

I would like to log into a Cisco router that is in a LAN

• via telnet or ssh
• as user <username> with a password <password>
• only from machines in the LAN 192.168.2.0/24

About the user:

I usually use the flat blue cable and connect to the router using Hyperterminal. I run enable and then I'm asked for a password. So I don't know the username associated with this password... What is the associated username?

Suppose it is <username>. I would like to run telnet 192.168.2.1 -l <username> and then enter the password. Or ssh <username>@192.168.2.1 and then enter the password.

I want this user to be able to telnet or ssh into the router only from machines inside the LAN 192.168.2.0/24.

I don't know precisely how to do that.

Do I need an access-list like this one?

access-list 101 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.1 eq 23

or

access-list 101 permit tcp 192.168.2.0 0.0.0.255 host 192.168.2.1 eq 22

Then do I have to associate this access-list to the router inside network interface (VLan1)?

Can you help me set up the sequence of commands I have to run to achieve that goal?

---

EDIT N°1

Ok. I ran:

conf t
line vty 0 4
login local

and:

conf t
username <username> privilege 15 secret <password>

I can log into the router as:

telnet 192.168.2.1
Username: <username>
Password: <password>

Question 1: How to make sure the router cannot be telneted into from outside the LAN?

Question 2: I cannot log into the router via SSH:

ssh <username>@192.168.2.1
ssh: connect to host 192.168.2.1 port 22: Connection refused

Answer 1

You can use these commands to set up telnet access

! Set username/password
username Lea password Shhh! 
! Create standard ACL to control access
ip access-list standard ONLY-THESE-GUYS
 permit 192.168.2.0 0.0.0.255
! Enable authentication 
aaa new-model
aaa authentication login default local
! enable virtual terminal sessions
line vty 0 15
access-class ONLY-THESE-GUYS in
transport input ssh telnet

Now you should be able to telnet to 192.168.2.1.

Answer 2

You'll need to have a hostname and a domain and generate the keys for ssh to work. My notebook says:

hostname gw99
ip domain name example.com

crypto key generate rsa modulus 2048

ip access-list standard LEGIT
 permit 192.168.2.0 0.0.0.255

line vty 0 4
 access-class LEGIT in
 privilege level 15
 transport input ssh

As no one else has mentioned it ... generally it's not considered safe to allow telnet, much better to stick to ssh.

Kind regards,

Jonathan.