1

I'm reading this article:

https://www.ciscozine.com/access-to-the-console-via-aux-port/

I don't understand why they use an IP address?

What if the router doesn't have an IP address? What if the router is a new router?

I need console access from the AUX port. What am I missing here?;)

4
  • 1
    That is about using an already configured router to access a different, maybe unconfigured, router. The router you use must already be configured and accessible.
    – Ron Maupin
    Oct 2 '20 at 14:47
  • Normally we connect the live router to the new router in which we don't have access and we connect the AUX of the current router to the other console port. But to telnet, we need the IP Address as per the above article. It seems the IP is for the router we don't have access. So, that is the question from the beginning. Why we need the IP as we connect physically? Normally If we have the IP address maybe we don't need the aux port to access it. Oct 2 '20 at 15:03
  • Of course, I already have access to the configured router. Now I need access to the unconfigured router, which is connected to the AUX port. Oct 2 '20 at 15:07
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17 '20 at 22:29
2

This idea would work only if the second router is configured in a network and is operating. You could then use it to connect to the unconfigured router's console. In effect, you're using the second router as a terminal server.

5
  • We have done this when making network changes that will cause one of the routers be disconnected, and we only have a non-technical person or someone who does not have rights on-site.
    – Ron Maupin
    Oct 2 '20 at 14:50
  • These days, it's hard to find a router that still has a aux port
    – Ron Trunk
    Oct 2 '20 at 14:51
  • Well, I already have access to the configured router, but how can I see the console output of the unconfigured router, which is connected to the AUX port? Oct 2 '20 at 15:09
  • @JasonHunter The configured router acts as your terminal, which is connected to the console of the unconfigured router. The IP address is the configured router.
    – Ron Trunk
    Oct 2 '20 at 15:15
  • I have a new router, which I want to configure. I connect this new routers' Console port to a router I already have access to and configured on the AUX port. I totally fail to understand how I can see the console output from this new router. Oct 3 '20 at 9:35
2

The below topology is what is described by the article access to the console via the AUX port. It means you telnet (or ssh) to an exposed port on the existing router which has been configured to make its AUX port available for use via telnet/ssh.

For this to work, you need to be able to login to the existing router. A common way of doing this in lights-out POP situations is to telnet/ssh to an IP address on a point-to-point circuit that terminates on that existing router, e.g. 192.0.2.2 as below:

  /--------\
  |  ISP   |
  \________/
      |
  192.0.2.2/30
      |
 +----------+                       +--------+
 | existing |AUX---RS232 cable---CON|  new   |
 |  router  |                       | router |
 +----------+                       +--------+

If you have two routers, both with CON and AUX ports, you can use them as remote console access to each-other. This is also very common in lights-out POPs where two routers both have the appropriate AUX ports.

2

(basically, I'm justg rephrasing what the linked article and the other answers say):

To use a (remote) router's AUX as a 1-port console server (a.k.a terminal server), you'll need:

A) a rollover cable from AUX of the router acting as the console server to CONSOLE of the device you want to access.

B) these lines on the router acting as the console server:

! without 'no exec', the router acting as the console server
! would present a console prompt when talked to by console/debugging output
! of the connected device
!
! It would then attempt to parse that console output as username/pw 
! and start to log quite strange login attempts and also lead to 
! questionable log entries on the AAA servers. 
      
 line aux0
  no exec
  transport input telnet

This will open port 2001 [1] on the router acting as the console server. You can then telnet into that port, and this will connect you to the console of the device attached.

We used to configure the following, to add some security and access restrictions:

! have some decent aaa setup on the router acting as console server
! ... which is probably in place already.
!
aaa authentication ...
aaa authorization ...

! many routers are configured with a Loopback interface for management, anyway.
! If not, create one, but keep an eye on what this might do to the possibly given 
! dynamic routing setup (i.e. make sure it does not become your EIGRP or OSPF 
! RouterID inadvertently) 
!    
int LoopbackNNN
 ip address nnn.nnn.nnn.nnn 255.255.255.255
!
! ...
!
! allow access only from the router's own looback address:
!
ip access-list standard ACLv4-CONSOLE-SERVER-ACCESS
 permit host nnn.nnn.nnn.nnn 
!
! ...
!
line aux0
 no exec
 transport input telnet
 access-class ACLv4-CONSOLE-SERVER-ACCESS in 
!
!

And then we would SSH into the router, and issue the following command, running telnet from the Loopback IP to the Loopback IP, Port 2001.

telnet nnn.nnn.nnn.nnn 2001 /source LoopbackNNN

The router acting as console server would AAA-authenticate/authorize the user again, and if successful, it would present the connected device's console in the SSH session.

Connecting that way also has the advantage of not having to worry about firewalls and not having to haggle with customer's security admins not wanting yet another port open towards the network infrastructure.

[Anecdote:]

There once was a series of Cisco 2821 and 2851 ISR G1 routers with a nasty memory bug that left them in ROMMON every so often after power was restored, and a customer with 80+ sites all over the country had a pair of them at every single site.

The mutual CON/AUX setup saved us hundreds of kilometers and dozens of travelling hours to get a router out of ROMMON every two weeks.

At one time, a failed IOS upgrade at literally the most remote site of that same customer left a Catalyst 3750 stack in utter disarray. Even an absolutely non-technical person could be guided to "yes Sir, please find devices XYZ-R001 and -R002, yes... , and do you see that flat cable connected to their 'AUX' port? ... Exactly! Please unplug these cable's other ends and connect them to the port called 'CONSOLE' of the two nearby devices with many ports called XZX-S001 and -S002. ... and yesSirthankyouverymuch we can work from here and your network will be back up when you return to work tomorrow morning."

[/Anecdote:]


[1] in most cases, it's port 2001, but depending on platform, it may be different.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.