I took over a couple of Cisco 2960x switches. They are configured with a telnet login. Now that telnet isn't that great (and my colleagues are afraid of CLI but might have to configure things too) I wanted to switch to SSH/GUI. Both ports are open but I don't have a user so I wanted to create an admin user over telnet.

I followed this instruction https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_0100.html

Typing in sh run I get the following lines for the user output

sw11#sh run
Building configuration...

Current configuration : 7921 bytes
! Last configuration change at 12:06:05 UTC Mon Feb 4 2019
! NVRAM config last updated at 13:23:44 UTC Fri Jan 11 2019
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname sw11
enable secret 5 REDACTED
no aaa new-model
switch 1 provision ws-c2960x-24td-l
switch 2 provision ws-c2960x-24td-l
ip domain-list a.co.uk
ip name-server
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
<<<<<interfaces here>>>>>
ip http server
ip http secure-server
logging trap notifications
snmp-server community public RO
alias exec ifs show interface status
alias exec backup copy system:running-config tftp://serv06/sw11-confg
line con 0
line vty 0 4
 password <unencrypted password>
line vty 5 15
 password <unencrypted password>
ntp server

My procedure to create a new user was

login over telnet

conf t
username admin privilege 15 password 7 <good password>

Now running sh run again there was not a single change in the entire output

Login over SSH or GUI didn't work either. Where did I make a mistake? How do I proceed from here?

  • Please post your full configuration.
    – user36472
    Feb 4, 2019 at 12:23
  • Added full show run output to the initial post Feb 4, 2019 at 12:37
  • For security, you should actually disable both the http and http-secure servers in your devices.
    – Ron Maupin
    Feb 4, 2019 at 16:57

1 Answer 1


The configuration has to include:

  • A hostname (hostname sw99)
  • A domain name (ip domain-name example.com)
  • You have to have generated the keys (crypto key generate rsa)
  • Enable the SSH server (ip ssh)

And once it works, disable telnet:

  • You have to permit SSH on the line (ip transport ssh)

Additionally, for high privilege users, you have to allow that privilege on the line:

line vty 0 4
 privilege level 15
 transport input ssh

It can be easy to miss one of the steps

  • Thank you. SSH is now working with that newly created user. But not the gui. Even thogh ip http server is in the show run. Do you have an idea what else might be missing? Feb 4, 2019 at 13:04
  • @KennyBlankenship please accept the answer, so that it doesn't keep popping up. You need to click the V-sign just under the voting arrows.
    – user36472
    Feb 4, 2019 at 13:09
  • @KennyBlankenship after the initial commands by jonathanjo above, you now need to add the command username admin password <password here> after that you should be able to login to the web GUI.
    – user36472
    Feb 4, 2019 at 13:11
  • I get a pop up that asks for login credentials, but after typing them in the return is just 401 Unauthorized Feb 4, 2019 at 14:21
  • Ok I found a solution: ip http authentication local Feb 4, 2019 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.