Re: Securing my router with SSH

Kevin Melton · ‎03-18-2004

I am receiving a T-1 from the INternet on a Serial interface on a 1721 router. I put the initial router configuration into the "Output Interpreter". I got a laundry list back that I have been working thru to make my router more secure.

One of the items on the list was to use SSH. I tried to follow the steps for setting up SSH on the router, but the "cry generate rsh" and the "ip ssh" commands do not seem to be on the IOS feature set.

I am currently running ver. 12.3(2)XE on the router??

Does this version not support the SSH functionality on the router?? Is there an automated way that I could have found out by myself??

Thanks

steven.wilson · ‎03-19-2004

If you check your requirements using the Cisco Feature Navigator via the Software downloads on the website it will help you discover the correct software revision for your needs. It may also need a memory upgrade too. The security features that you wish to use will probably need more memory. This checking function is also available on the website. It usually hurts my head by going aroung in circles between the two, but an answer can be found.

Cheers,

Steve.

b.carbery · ‎03-21-2004

What is full image name running on your router?

ou need an IPSEC image, i.e. a 12.3(2)XE IP Plus IPSEC56 verion of IOS.

Note that some images only support DES encryption, others allow 3DES or DES. Most software clients will not have these settings as the default, and in my experience you need to hardset the encryption method on the client as negiation doesn't work.

Kevin Melton · ‎03-27-2004

The full version name is Version 12.2(15)T11. It is the Firewall/IDS/3DES Feature set...

b.carbery · ‎03-29-2004

Ok, you can use the feature navigator at the software center:

http://www.cisco.com/kobayashi/sw-center/index.shtml

It's actually linked under Tools -> Software Advisor.

Click on 'Find software with the features I need'. Should be self-explanatory from there.

Edit: As you may not have access to this page I logged in to find the 1721 platform is not supported yet by this tool. I would suggest talking to TAC at this point.