TechKnowSurge
Cisco CCNA 4.8 Cisco CCNA 2.8 Cisco CCST Cybersecurity 2.5 Cisco CCST Cybersecurity 1.4 Cisco CCST Networking 6.2 Cisco CCST Cybersecurity 2.1
TechKnowSurge Catalog Videos DEMO: Configure SSH
VideoNetworkFree

DEMO: Configure SSH

Telnet exposes network credentials and traffic in plain text, making SSH the required alternative for secure remote switch management. This content covers the full configuration process for enabling SSH on a Cisco switch, from verifying hardware capability to restricting VTY lines and testing the encrypted connection.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Telnet has long been the default method for remote device management, but it presents a serious security liability: every byte transmitted, including usernames and passwords, travels across the network in plain text and can be intercepted by anyone with access to the wire. SSH, or Secure Shell, eliminates this risk by encrypting all traffic between the client and the managed device, making captured data unreadable to an attacker. Replacing Telnet with SSH is a foundational step in hardening any network infrastructure. Configuring SSH on a Cisco switch requires several sequential steps. First, the IOS image must be verified to include the K9 designation, which confirms cryptographic capability. A hostname and IP domain name must be assigned to the device, as both are required inputs for RSA key generation. The crypto key generate rsa command creates the encryption key pair, and selecting 2048 bits provides a stronger level of encryption than the default. Once the key is generated, SSH is locked to version 2 to avoid the known vulnerabilities present in version 1. With SSH enabled, Telnet access must be explicitly removed by configuring the VTY lines to accept only SSH connections. A local user account with a strong, unique password is then created so the device can authenticate incoming SSH sessions against its own user database using the login local command. After completing these steps, an SSH client can connect to the switch, accept the device's self-signed certificate, and authenticate securely, giving administrators full encrypted management access from anywhere on the network.

What you'll learn

What's covered

Configuring SSH on a Switch

Aligned to

Cisco CCNA
4.8 Configure network devices for remote access using SSH
2.8 Describe network device management access
Cisco CCST Cybersecurity
2.5 Implement secure access technologies
1.4 Explain encryption methods and applications
2.1 Describe TCP/IP protocol vulnerabilities
Cisco CCST Networking
6.2 Describe foundational security concepts

Key terms

Secure Shell
SSH
A cryptographic network protocol that provides secure remote login and command execution over an unsecured network.
Encryption
The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.
RSA
An asymmetric encryption algorithm based on the difficulty of factoring large prime numbers, widely used for secure data transmission.
Telnet
Telnet is a legacy remote terminal protocol that transmits all data including credentials in cleartext; it is considered insecure and serves as a security training example of why encrypted alternatives like SSH are required.
VTY Line
A virtual terminal line on a Cisco device that controls remote access connections such as SSH or Telnet.

Topics

Ssh Cisco Ios Network Security Remote Access Encryption Vty Configuration Networking

Transcript

Why SSH Instead of Telnet

Now I have my switch all set up so that I can remote into it and manage it through telnet. The problem with telnet though is that it passes information back and forth in clear text. What that means is the data that's going across the line could be captured by anybody and they could see what's going on, to include passwords. Passwords are not secure through telnet, and so it's not considered a secure method of communicating.

So what I need to do is set up something like SSH. SSH is secure shell, and so what it does is it encrypts the traffic going between my switch and my laptop, so that way when I'm remoting into it no one can capture that data going between it and be able to leverage that to be able to compromise the piece of equipment.

So I'm on my switch right now. I'm going to set it up to do SSH. Just know that some of these steps are set up by default on some equipment, but we're going to go through all the steps so we can see what it looks like.

Checking the Image

So I'm on the switch. The first thing that I'm going to do is I'm going to do a show version and take a look. What I'm looking for is the base image, and I want to make sure that the base image has K9 in it. The reason that is is because K9 specifies that it's capable of having this secure shell set up on it, this SSH. Essentially it can do certificates, it can set up certificates. So this does have the capability of doing it, so I'm going to exit out of here.

Host Name and Domain

One thing that I need is I need a host name. It actually is already set up by default, I got switch, but I probably want to call it maybe something a little different. Maybe I just want to call it switch one. So I'm going to go into global configuration mode, type in host name, and I'll call this switch one. And so now I'm calling the switch one.

The other thing that I'm going to need this to be part of is some sort of domain. So I'm going to type in ip domain-name, and I'm going to call this andylan, so andy.lan. Now it's part of this andy.lan.

Generating the Key

Next what I'm going to need to do is generate a key for this. Encryption uses certificates to encrypt the data as it's being transferred back and forth. So to create or generate this, I'm going to type in crypto key generate rsa. And it's going to ask me how many bits do I want, and I'm going to actually do 2048. This is going to be a higher level of encryption to it, so I'm going to choose that, and now it's generating this key, this certificate that it's going to use to encrypt the traffic.

Once that finishes — and it did take a little bit of time, it says here it took 72 seconds in order to complete that operation — but once it's done, now what I want it to do is I want it to only use version two. I don't want to use version one; by default it will use both, I only want to use version two. So I'm going to type in ip ssh version 2, hit enter, and now we've got it set so it'll be version 2.

Restricting the Lines to SSH

And now the last thing that I need to do, because it'll still accept telnet connections at this point: what I'm going to do is get into the vty connections, and I'm going to set it so that it only will accept SSH connections and not telnet. So I'm going to type in line vty, and I'm going to do it for all of the vty connections, so 0 through 15. And then I'm going to type in transport input. I'll do the question marks to see what our options are, and as you can see there's all, none, ssh and telnet. I just want SSH, so I'm going to type in ssh and hit enter, and now it should just be accepting SSH.

Setting Up a Local User

Next what I'm going to do is I'm going to type in this command called login local. What login local does is it says look at the local user database to use for this type of connection. So I'm going to type in login local. But we don't really have a local database at this point in time, we don't have any local users set up. So let's go ahead and exit out of this and get back into the global configuration mode, and let's set up a user that's going to access this.

So to do that, to set up a user, I'll type in username, and then I'll type in the username that I want to add. In this case I'll just add myself, so andrew is going to be the username. And then I need to give myself a password, so I'm going to type in password. Once again, I always like to have more complex passwords, and so if I were to go to a password generator and create a password that is unique to this login, so that way no one else can compromise it, and I'll plug that in there and hit enter. And now I have a username set up in there.

Testing the Connection

So I think it's time to see if this is all configured correctly. What I'm going to do is I'm going to go up to my icon again, select new session. So we create a new session, it's an SSH, so this is already set up. I'm going to type in the IP address that I want to connect to, which is the IP address of my switch, so that is dot 2. I'm going to click open.

And it's going to first of all ask me, do I accept the certificate of this device. Now the thing is that this is what's called a self-signed certificate. It was created and generated on the device. It will encrypt the traffic, and so I just need to make sure that the device I'm connecting to is truly the device I want to connect to. I don't want to accept a certificate to a device that I'm not sure what the equipment is. So I do know that this is what I want to connect to, I know that I want to accept this certificate. So in this case I could either accept, and then it would accept it from here on out, or I can connect once and it would just be for this particular time. I'm just going to connect once this time. Next time I'll probably hit accept, and then it will never prompt me for again, because it'll save that as a connection.

Log in as — so I'm going to log in as andrew, and then it's asking for the password, so I'll go to my password. And now I'm on the switch. I'm going to hit enable, and it's going to ask the password for the privileged exec mode, and so that was my secret. Hit enter.

I am now on the switch and I can now manage this switch through this secure SSH connection, from anywhere that I'll have access to this switch or to this network. So now I can securely manage this, and that is SSH and how to manage a switch through SSH, or set up management of your switch through SSH.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →