1

I am have trouble understanding how Cisco iOS maps console access services like SSH to IP addresses.

Assume the following:

  • There are no acls blocking traffic
  • There is the typical SSH server declaration
line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh

Given the above, should you expect SSH to be accessible on every interface with an IP address? Is there an interface setting to allow/disalow this? Is it only some types of interfaces (VLAN, loopback, etc.)?

Update: Config

I can ping 192.168.1.230 but I cannot SSH to it. I get no connection accepted; however, I can ping it (it stops pining if i disable FE 8 so pretty sure it is authentic ping).

!
! Last configuration change at 19:08:00 UTC Thu Sep 29 2022 by CDIAdmin
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname IPSecTest1
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
no aaa new-model
memory-size iomem 10
service-module wlan-ap 0 bootimage autonomous
!
!
ip cef
!
!
!
!


!
ip dhcp excluded-address 10.10.10.1
!
ip dhcp pool ccp-pool
 import all
 network 10.10.10.0 255.255.255.248
 default-router 10.10.10.1
 lease 0 2
!
!
!
no ip domain lookup
ip domain name ipsectest1
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
license udi pid CISCO891W-AGN-A-K9 sn FTX1819814X
!
!
username XXXXXXX privilege 15 secret 5 XXXXXXXXXXXXXXXXXX
!
redundancy
!
!
!
!
!
ip ssh version 2
!
!
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp key MYPASSWORD address 192.168.210.230
!
!
crypto ipsec transform-set og-trans esp-aes 256 esp-sha-hmac
 mode tunnel
!
!
!
crypto map og-map 10 ipsec-isakmp
 set peer 192.168.210.230
 set transform-set og-trans
 set pfs group2
 match address ipsec-acl
!
!
!
!
!
interface Loopback0
 ip address 10.100.100.1 255.255.255.0
!
interface FastEthernet0
 no ip address
!
interface FastEthernet1
 no ip address
!
interface FastEthernet2
 no ip address
!
interface FastEthernet3
 no ip address
!
interface FastEthernet4
 no ip address
!
interface FastEthernet5
 no ip address
!
interface FastEthernet6
 no ip address
!
interface FastEthernet7
 no ip address
!
interface FastEthernet8
 ip address 192.168.1.230 255.255.254.0
 ip access-group outside-in in
 duplex auto
 speed auto
!
interface GigabitEthernet0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface wlan-ap0
 description Service module interface to manage the embedded AP
 ip unnumbered Vlan1
 arp timeout 0
!
interface Wlan-GigabitEthernet0
 description Internal switch interface connecting to the embedded AP
 no ip address
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
 ip address 10.10.10.1 255.255.255.248
 ip tcp adjust-mss 1452
!
interface Async1
 no ip address
 encapsulation slip
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip route 0.0.0.0 0.0.0.0 192.168.1.1 name DGW
!
ip access-list extended ipsec-acl
 permit ip host 10.100.100.1 10.200.200.0 0.0.0.255
 permit ip host 10.100.100.2 10.200.200.0 0.0.0.255
ip access-list extended outside-in
 permit ip any any
!
access-list 23 permit 10.10.10.0 0.0.0.7
no cdp run
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------

Cisco Configuration Professional (Cisco CP) is installed on this device
and it provides the default username "cisco" for  one-time use. If you have
already used the username "cisco" to login to the router and your IOS image
supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit
this session.

It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.

username <myuser> privilege 15 secret 0 <mypassword>

Replace <myuser> and <mypassword> with the username and password you
want to use.

-----------------------------------------------------------------------
^C
banner login ^C
-----------------------------------------------------------------------
Cisco Configuration Professional (Cisco CP) is installed on this device.
This feature requires the one-time use of the username "cisco" with the
password "cisco". These default credentials have a privilege level of 15.

YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE
PUBLICLY-KNOWN CREDENTIALS

Here are the Cisco IOS commands.

username <myuser>  privilege 15 secret 0 <mypassword>
no username cisco

Replace <myuser> and <mypassword> with the username and password you want
to use.

IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL
NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.

For more information about Cisco CP please follow the instructions in the
QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
-----------------------------------------------------------------------
^C
!
line con 0
 login local
line 1
 modem InOut
 speed 115200
 flowcontrol hardware
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
 transport output pad telnet rlogin udptn ssh
line aux 0
line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
!
!
end
4
  • 4
    Note that you have "access-class 23 in" so access is restricted by this access list.
    – JFL
    Sep 29 at 15:01
  • 2
    "There are no acls blocking traffic" That is not true. You are only allowing hosts with addresses 10.10.10.1 to 10.10.10.6 in. From which address are you trying to use SSH? Is it from one of those hosts?
    – Ron Maupin
    Sep 29 at 20:37
  • so a global acl is applied even when not explicitly declared in an interface paramter?
    – Liam Kelly
    Sep 29 at 20:50
  • 1
    You explicitly applied it to the VTY lines, which is what allows SSH traffic in.
    – Ron Maupin
    Sep 29 at 20:55

2 Answers 2

3

Given the above, should you expect SSH to be accessible on every interface with an IP address?

Unless otherwise restricted, yes.

Is there an interface setting to allow/disalow this?

You can apply an interface ACL to restrict access from certain interfaces.

Is it only some types of interfaces (VLAN, loopback, etc.)?

All interfaces. Using a lookback is recommended in most cases as it is always available.

3
  • odd because i am not seeing that, but good to at least have that clarity in typical behavior. Going to leave the question open a little longer in case anyone has anything additional to add.
    – Liam Kelly
    Sep 29 at 14:56
  • What are you seeing that's different?
    – Ron Trunk
    Sep 29 at 15:08
  • Connection Refused at a TCP level
    – Liam Kelly
    Sep 29 at 15:57
3

Absent an ACL that blocks using an interface, you can connect to any router interface that is up and active. Generally, you want to use a loopback address because a loopback interface does not go down unless you specifically shut it down. A physical interface or subinterface tied to a physical interface will go down if the cable is disconnected, or there is some other problem that causes the link to go down such as the other end of the link going down.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.