2

I took over a couple of Cisco 2960x switches. They are configured with a telnet login. Now that telnet isn't that great (and my colleagues are afraid of CLI but might have to configure things too) I wanted to switch to SSH/GUI. Both ports are open but I don't have a user so I wanted to create an admin user over telnet.

I followed this instruction https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_0100.html

Typing in sh run I get the following lines for the user output

sw11#sh run
Building configuration...

Current configuration : 7921 bytes
!
! Last configuration change at 12:06:05 UTC Mon Feb 4 2019
! NVRAM config last updated at 13:23:44 UTC Fri Jan 11 2019
!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname sw11
!
boot-start-marker
boot-end-marker
!
enable secret 5 REDACTED
!
no aaa new-model
switch 1 provision ws-c2960x-24td-l
switch 2 provision ws-c2960x-24td-l
!
ip domain-list a.co.uk
ip name-server 172.24.0.21
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
<<<<<interfaces here>>>>>
!
ip http server
ip http secure-server
!
logging trap notifications
!
snmp-server community public RO
!
alias exec ifs show interface status
alias exec backup copy system:running-config tftp://serv06/sw11-confg
!
line con 0
line vty 0 4
 password <unencrypted password>
 login
line vty 5 15
 password <unencrypted password>
 login
!
ntp server 10.123.131.1
end

My procedure to create a new user was

login over telnet

enable
conf t
username admin privilege 15 password 7 <good password>

Now running sh run again there was not a single change in the entire output

Login over SSH or GUI didn't work either. Where did I make a mistake? How do I proceed from here?

  • Please post your full configuration. – user36472 Feb 4 at 12:23
  • Added full show run output to the initial post – Kenny Blankenship Feb 4 at 12:37
  • For security, you should actually disable both the http and http-secure servers in your devices. – Ron Maupin Feb 4 at 16:57
3

The configuration has to include:

  • A hostname (hostname sw99)
  • A domain name (ip domain-name example.com)
  • You have to have generated the keys (crypto key generate rsa)
  • Enable the SSH server (ip ssh)

And once it works, disable telnet:

  • You have to permit SSH on the line (ip transport ssh)

Additionally, for high privilege users, you have to allow that privilege on the line:

line vty 0 4
 privilege level 15
 transport input ssh

It can be easy to miss one of the steps

  • Thank you. SSH is now working with that newly created user. But not the gui. Even thogh ip http server is in the show run. Do you have an idea what else might be missing? – Kenny Blankenship Feb 4 at 13:04
  • @KennyBlankenship please accept the answer, so that it doesn't keep popping up. You need to click the V-sign just under the voting arrows. – user36472 Feb 4 at 13:09
  • @KennyBlankenship after the initial commands by jonathanjo above, you now need to add the command username admin password <password here> after that you should be able to login to the web GUI. – user36472 Feb 4 at 13:11
  • I get a pop up that asks for login credentials, but after typing them in the return is just 401 Unauthorized – Kenny Blankenship Feb 4 at 14:21
  • Ok I found a solution: ip http authentication local – Kenny Blankenship Feb 4 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.