I am have trouble understanding how Cisco iOS maps console access services like SSH to IP addresses.
Assume the following:
- There are no acls blocking traffic
- There is the typical SSH server declaration
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
Given the above, should you expect SSH to be accessible on every interface with an IP address? Is there an interface setting to allow/disalow this? Is it only some types of interfaces (VLAN, loopback, etc.)?
Update: Config
I can ping 192.168.1.230
but I cannot SSH to it. I get no connection accepted; however, I can ping it (it stops pining if i disable FE 8 so pretty sure it is authentic ping).
!
! Last configuration change at 19:08:00 UTC Thu Sep 29 2022 by CDIAdmin
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname IPSecTest1
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
no aaa new-model
memory-size iomem 10
service-module wlan-ap 0 bootimage autonomous
!
!
ip cef
!
!
!
!
!
ip dhcp excluded-address 10.10.10.1
!
ip dhcp pool ccp-pool
import all
network 10.10.10.0 255.255.255.248
default-router 10.10.10.1
lease 0 2
!
!
!
no ip domain lookup
ip domain name ipsectest1
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
license udi pid CISCO891W-AGN-A-K9 sn FTX1819814X
!
!
username XXXXXXX privilege 15 secret 5 XXXXXXXXXXXXXXXXXX
!
redundancy
!
!
!
!
!
ip ssh version 2
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key MYPASSWORD address 192.168.210.230
!
!
crypto ipsec transform-set og-trans esp-aes 256 esp-sha-hmac
mode tunnel
!
!
!
crypto map og-map 10 ipsec-isakmp
set peer 192.168.210.230
set transform-set og-trans
set pfs group2
match address ipsec-acl
!
!
!
!
!
interface Loopback0
ip address 10.100.100.1 255.255.255.0
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
no ip address
!
interface FastEthernet5
no ip address
!
interface FastEthernet6
no ip address
!
interface FastEthernet7
no ip address
!
interface FastEthernet8
ip address 192.168.1.230 255.255.254.0
ip access-group outside-in in
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered Vlan1
arp timeout 0
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
no ip address
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.10.10.1 255.255.255.248
ip tcp adjust-mss 1452
!
interface Async1
no ip address
encapsulation slip
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1 name DGW
!
ip access-list extended ipsec-acl
permit ip host 10.100.100.1 10.200.200.0 0.0.0.255
permit ip host 10.100.100.2 10.200.200.0 0.0.0.255
ip access-list extended outside-in
permit ip any any
!
access-list 23 permit 10.10.10.0 0.0.0.7
no cdp run
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------
Cisco Configuration Professional (Cisco CP) is installed on this device
and it provides the default username "cisco" for one-time use. If you have
already used the username "cisco" to login to the router and your IOS image
supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit
this session.
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
username <myuser> privilege 15 secret 0 <mypassword>
Replace <myuser> and <mypassword> with the username and password you
want to use.
-----------------------------------------------------------------------
^C
banner login ^C
-----------------------------------------------------------------------
Cisco Configuration Professional (Cisco CP) is installed on this device.
This feature requires the one-time use of the username "cisco" with the
password "cisco". These default credentials have a privilege level of 15.
YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE
PUBLICLY-KNOWN CREDENTIALS
Here are the Cisco IOS commands.
username <myuser> privilege 15 secret 0 <mypassword>
no username cisco
Replace <myuser> and <mypassword> with the username and password you want
to use.
IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL
NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.
For more information about Cisco CP please follow the instructions in the
QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
-----------------------------------------------------------------------
^C
!
line con 0
login local
line 1
modem InOut
speed 115200
flowcontrol hardware
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin udptn ssh
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
login local
transport input telnet ssh
line vty 5 15
access-class 23 in
privilege level 15
login local
transport input telnet ssh
!
!
end
10.10.10.1
to10.10.10.6
in. From which address are you trying to use SSH? Is it from one of those hosts?