Authenticate Switch with Cisco ACS with SSH instead of Telnet

[taufeeq taufeeq]

Dear All,

I want to authenticate the switches in DMZ zone(Behind Firewall) against AAA server. Config used under line vty is mentioned. Unfortunately our security colleagues are asking me to use SSH instead of telnet as its not secure. Please help me with the SSH config of ACS. Am I lacking the understandability of telnet & AAA ??? please clarify my doubt. 

line con 0
 session-timeout 5
 exec-timeout 5 0
 password 7 094F471A1A0A
 login authentication noauth
 transport preferred none
line vty 0 4
 session-timeout 5
 exec-timeout 5 0
 password 7 104D000A0618
 login authentication vty
 transport preferred telnet
 transport input telnet

Thanks in advance,

Taufeeq.

[Mark Malone]

Hi

if its just allowing ACS use ssh instead of telnet remove telnet from vty

no transport preferred telnet
no transport input telnet

change to transport input ssh & transport preferred ssh

You will need to have ssh enabled though aswell globally on the switch

ip ssh ver 2

ip domain-name x/x

ip ssh authentication-retries 3

ip ssh timeout 60

and generate your secure keys

crypto key generate rsa ----  use 1024 for ver2

check with show ip ssh