can I configure ssh on cisco 4331 mgmt port

[moman62]

Cisco 4331 router (IOS - isr4300-universalk9.17.09.04a.SPA.bin)

I already have Mgmt-intf configured, wanted to know if I could also use the G0 port for ssh?

[liviu.gheorghe]

Yes you can.

In order to enable ssh on your router, you have to configure the following in configuration mode:

1. a hostname using the command hostname <router name>

2. a domain name using the command ip domain name <some domain name>

3. a certificate for the router using the command crypto key generate rsa modulus 1024

And now you can ssh into your router.

[Richard Burts]

@liviu.gheorghe has supplied a good explanation of the steps to enable SSH. But I think that is not what the OP was asking.

I admit that I am not clear what the OP was asking. It says "I already have Mgmt-intf configured" What is Mgmt-intf? What is the relationship between Mgmt-intf and G0?

But I agree with @liviu.gheorghe that once SSH is enabled, any interface that is enabled and reachable should be able to accept and process SSH.

[liviu.gheorghe]

The question in the OP is related to this post - https://community.cisco.com/t5/switching/trying-to-configure-mgmt-port-on-cisco-4331-router/m-p/5260314#M576892

Mgmt-intf is the vrf in which Gi0/0 is configured.

[moman62]

what I'm trying to say is, I have the vrf/management port on the cisco 4331 configured. I can now view and login to the webgui page. the vrf port has a default name of Mgmt-intf. I just want to know since it is a management port instead of using vty for ssh, could i use the G0 mgmt port on the 4331 for ssh? or any other connections? 

[liviu.gheorghe]

Yes, you can. You just have to configure the ssh server on your router like I detailed in my first post.

[Richard Burts · Accepted solution]

Thanks for the clarification. The OP asks a question in a slightly different way :" instead of using vty for ssh, could i use the G0 mgmt port on the 4331 for ssh?" Note that vty is "virtual" so you do not actually connect to vty. I believe that any time you use SSH it uses vty.  The question really is what physical port does the traffic use. If you configure G0 (in the management vrf), give it an IP, and use that IP for SSH, then your management traffic is isolated and does not have any impact on data traffic.

[moman62]

ok, so let me get this clear, can I add as many ip addresses to the mgmt port since it already has one and would I need to create an ACL?

[liviu.gheorghe]

Yes, you can add more than one IP address to the management port, interface Gi0, by using the interface configuration command

ip address <ip address> <netmask> secondary

Why do you think you need to assign more IP addresses to the management interface?

For what purpose do you need to create an ACL? To restrict access to the management interface G0?

[Richard Burts]

I agree with LG that it would help if we knew why you might want an ACL. And I would suggest that if the purpose is to restrict who can SSH to the device that it would be better to apply an ACL to the vty rather than to G0. If you want to be sure that only management traffic uses that interface (SSH, syslog, snmp, etc) then it would be appropriate to apply an ACL to G0.

[moman62]

it was just a question! if I could do that! for future refs! about adding another ip address to Gi0 as for the ACL again its just a question does not mean I may implement anything. so since I'm using 10.0.10.x already for GI0, I just implement SSH to that ip address?

[liviu.gheorghe · Accepted solution]

Ok, I understand. The reason I asked the question about more IP's on the interface is because you really don't need more than one IP on the management interface. You ssh to that IP in order to manage your router.

[moman62]

it worked! 
. conf t
. int GI0
. ip ssh version 2

[liviu.gheorghe]

@moman62 I'm glad it worked out for you.