Hi Joseph,
i dont know if it support ssh?
You need a crypto image to support ssh but you can also verify by doing this command: ip ssh ver in global config and if you want to know if a feature is supported by your IOS/architecture just go on Cisco feature navigator site : http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp
If your router supports ssh, in order to use it you must:
1) give a hostname to your router with the global config hostname command
2) configure a domain name with the global config ip domain-name command
3) configure a local user with the global config username xxx privilege xx secret xxx command
how to insert username and password for ssh on router?
The 3rd action answers this question
4) generate a rsa key with the global config crypto key generate rsa modulus 1024 command
5) optionaly enable ssh version 2 with the global config ip ssh version 2 command
6) on line vty: login local
how to disable telnet?
7) on line vty: transport input ssh
What is this pls transport input telnet ssh? you mean telnet service will be overwrite by ssh
This means you can telnet to your vty line and also ssh to it with the command in 7) you can only ssh to it
Concerning your ACL the deny any any at the end is useless unless you want to log but then you have to add the log keyword at the end
why these 2 lines ?
access-list 26 permit 192.168.2.0 0.0.0.63
access-list 26 permit 192.168.3.0 0.0.0.63
For me they are useless as they will never get hit because an ACL is parsed from top to bottom and once a match is done the parsing stops, the 2 first lines will get matched before.
where logs will be stored and how to check those logs?
What do you want to log ? the access with ssh to your router? all access or only failed ones?
The config given below your question is for the archive feature not for authentication logging.
You can log in many places but the best is a syslog server( a free one is tftpd32 for windows) and the command is simple:
logging x.x.x.x where x.x.x.x is the ip address or hostname( if you can resolve to ip) of your syslog server
But first verify logging is enabled with the show log command and if not then enable it with the global config logging on command
then you can use the logging feature on your final explicit deny with the log keyword or if you have got a security IOS you can use this global command: security authentication failure rate xx log which will block for 15 sec after xx attempts and log the attempts.
Regards.
Alain.
Don't forget to rate helpful posts.
