Can not configure SSH on Cisco 2960

[aelharam]

Hi there,

Im having issues setting up ssh on my cisco 2960. 

Can anyone help.

Many Thanks

Abdo

[Julio E. Moisa]

Hi

Not all the IOS for 2960 are able to support SSH, the IOS must be K9 in order to support SSH. Now the configuration should be

conf t

ip domain name mydomain.com
hostname SWITH01
ip ssh ver 2
ip ssh authentication 3
ip ssh time 120

crypto key generate rsa (press enter)

type: 1024 (at least and press enter again)

line vty 0 15
transport input ssh
login local   <--- if you are going to use local credentials you need to disable aaa new-model prepending 'no')

:-)

[aelharam]

Hi There,

I tried that, but how do i know what IP address to use when i want to initiate an ssh Session ?

Thanks

[Julio E. Moisa]

Hi

It must be the management vlan, imagine the vlan 100 is your management vlan, so you should have:

vlan 100
name MANAGEMENT

interface vlan 100
name MANAGEMENT
ip address 192.168.100.50 255.255.255.0
no shutdown

ip default-gateway 192.168.100.1  <-- it is the default gateway for the network associated to the vlan 100, this IP .1 is created on a layer 3 device.

now in order to enable the SVI (interface vlan) you can:

- Assign the vlan to an access port (not recommended for the management vlan)
or
- Allow the vlan under a trunk, by default the trunk interfaces pass all the vlans created locally on the switch.

so you you could have:

interface fastethernet 0/48
description TO-DISTRIBUTION-SWITCH
switchport mode trunk   (passing all the vlans by default)
no shutdown

:-)

[aelharam]

Hi Julio,

I tried that but please see attached and tell me what i did wrong.

[Julio E. Moisa]

Hi

You are getting an overlapping error message, it means you cannot configure 2  IP addresses of the same network on 2 different interfaces at the same device.

The IP address (172.28.15.20) you are configuring on the interface vlan 10 belongs to the same network (172.28.15.0/24) like the IP on the interface vlan 5. 

Also you will not able to reach the device is the configured default-gateway IP is not the default gateway for the IP of the management vlan. You can keep only 1 ip default-gateway IP on the switches. 

vlan 100

int vlan 100
ip address 172.28.15.20 255.255.255.0

ip default-gateway 172.28.15.254

Note: If you are connected remotely to the switch and you change the default-gateway you will lost connectivity to the switch. 

[aelharam]

So how can i remove that IP address from Vlan 5 and assign that IP to Vlan 10 as it will be used to remote into the switch

[Julio E. Moisa]

Remember the vlans have associated a network each other, so Im not sure if you have 2 networks, 1 for the vlan 5 and other network for the vlan 10. 

Imagine:

Vlan 5 - network associated: 192.168.5.0/24
Vlan 10 - network associated: 192.168.10.0/24

You cannot have this on the same device, it will not be allowed.

interface vlan 5
ip address 192.168.5.20 255.255.255.0

interface vlan 10
ip address 192.168.5.21 255.255.255.0

Because both IP addresses belong to the same network 192.168.5.0/24

The management vlan will be the only vlan with default gateway on the switch. You can have multiple interface vlan on the switch but only 1 can be the management vlan and it will be the associated with the default gateway (ip default-gateway IP address)

[aelharam]

How can i remove the Ip address from Vlan 5 and allow only vlan 10 to have an ip address?

[Julio E. Moisa]

Well there are 2 ways:

interface vlan 5
no ip address x.x.x.x y.y.y.y

or 

no interface vlan 5

But you can left there the interface vlan 5, the important here is the IP address associated to the IP default-gateway 

[aelharam]

So now i have removed the ip address from Vlan 5 and gave vlan 10 (mgnt) 172.28.15.100

Should i now be able to connect to it via ssh using that IP address?

[Julio E. Moisa]

Yes,

are you able to ping the IP 172.28.15.100 from your computer.  If you already have local credentials you should be able to log in remotely otherwise you need to created it:

conf t

no aaa new-model

username cisco privi 15 pass cisco123

[aelharam]

No but i have another switch which is on 172.28.15.254 and i can ping that please see screenshot.

[Julio E. Moisa]

Ok just a question, what is the default gateway of the network 172.28.15.0/24

[aelharam]

172.28.15.254