I would like to log into a Cisco router that is in a LAN

  • via telnet or ssh
  • as user <username> with a password <password>
  • only from machines in the LAN

About the user:

I usually use the flat blue cable and connect to the router using Hyperterminal. I run enable and then I'm asked for a password. So I don't know the username associated with this password... What is the associated username?

Suppose it is <username>. I would like to run telnet -l <username> and then enter the password. Or ssh <username>@ and then enter the password.

I want this user to be able to telnet or ssh into the router only from machines inside the LAN

I don't know precisely how to do that.

Do I need an access-list like this one?

access-list 101 permit tcp host eq 23


access-list 101 permit tcp host eq 22

Then do I have to associate this access-list to the router inside network interface (VLan1)?

Can you help me set up the sequence of commands I have to run to achieve that goal?


Ok. I ran:

conf t
line vty 0 4
login local


conf t
username <username> privilege 15 secret <password>

I can log into the router as:

Username: <username>
Password: <password>

Question 1: How to make sure the router cannot be telneted into from outside the LAN?

Question 2: I cannot log into the router via SSH:

ssh <username>@
ssh: connect to host port 22: Connection refused
  • You need to set up the VTY lines for this. You can specify telnet or SSH, and you must have some type of authentication.
    – Ron Maupin
    Oct 4, 2017 at 17:07
  • Did you include the transport for SSH in your VTY configuration?
    – Ron Maupin
    Oct 4, 2017 at 17:37
  • To restrict access, you need to add the ACL and access class statements from the answer below. For ssh, you need to enable the ssh server. I forget the exact commands off of the top of my head. I could look them up -- but so could you.
    – Ron Trunk
    Oct 4, 2017 at 17:42
  • I don't know how to do that. Ron T. suggested the command: "access-class ONLY-THESE-GUYS in transport input ssh telnet" but with the router Cisco 887VA I am using, the maximum command I can enter is "access-class 50 in" (given that I entered this before: "access-list 50 permit") Oct 4, 2017 at 17:42
  • I edited my answer below. Forgot the "ip access-list"
    – Ron Trunk
    Oct 4, 2017 at 17:44

2 Answers 2


You can use these commands to set up telnet access

! Set username/password
username Lea password Shhh! 
! Create standard ACL to control access
ip access-list standard ONLY-THESE-GUYS
! Enable authentication 
aaa new-model
aaa authentication login default local
! enable virtual terminal sessions
line vty 0 15
access-class ONLY-THESE-GUYS in
transport input ssh telnet

Now you should be able to telnet to

  • Thank you Ron Trunk. I studied carefully this sequence of commands and could achieve my goals. I also ran the "crypto" command like @jonathanjo suggested to be able to login via SSH into the router. Oct 6, 2017 at 14:50

You'll need to have a hostname and a domain and generate the keys for ssh to work. My notebook says:

hostname gw99
ip domain name example.com

crypto key generate rsa modulus 2048

ip access-list standard LEGIT

line vty 0 4
 access-class LEGIT in
 privilege level 15
 transport input ssh

As no one else has mentioned it ... generally it's not considered safe to allow telnet, much better to stick to ssh.

Kind regards,


  • Thank you. The "crypto" command was indeed necessary. Kind regards. Oct 6, 2017 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.